CVE-2018-3646 Information disclosure in Multiple

Medium 5.6 Published 14 Aug 2018 Updated 29 May 2026

Local attackers with guest OS privileges can read sensitive L1 cache data via speculative execution side-channels, requiring microcode or OS patches.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2018-3646?

CVE-2018-3646 is a medium-severity vulnerability in Intel Corporation Multiple, published on 14 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache to an attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis.

Weakness: CWE-200

Which versions are affected by CVE-2018-3646?

It affects 8 products.

Linux distribution packages (23)

`xen` SUSE:Enterprise Storage 4	All versions	`4.7.6_04-43.39.1`
`xen` SUSE:Linux Enterprise Desktop 12 SP3	All versions	`4.9.2_10-3.41.1`
`kgraft` SUSE:Linux Enterprise Live Patching 12	All versions	`1.0-23.9.1`
`kgraft` SUSE:Linux Enterprise Live Patching 12 SP3	All versions	`1.0-23.9.1`
`kgraft-patch-SLE12-SP3_Update_14` SUSE:Linux Enterprise Live Patching 12 SP3	All versions	`2-2.1`
`kgraft-patch-SLE12-SP3_Update_15` SUSE:Linux Enterprise Live Patching 12 SP3	All versions	`2-2.1`
`kernel-livepatch-SLE15_Update_2` SUSE:Linux Enterprise Live Patching 15	All versions	`2-2.1`
`kernel-livepatch-tools` SUSE:Linux Enterprise Live Patching 15	All versions	`1.1-5.3.1`
`xen` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`4.10.1_08-3.6.1`
`xen` SUSE:Linux Enterprise Module for Server Applications 15	All versions	`4.10.1_08-3.6.1`
`xen` SUSE:Linux Enterprise Server 11 SP4	All versions	`4.4.4_36-61.37.2`
`xen` SUSE:Linux Enterprise Server 12 SP1-LTSS	All versions	`4.5.5_26-22.55.2`
`xen` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`4.7.6_04-43.39.1`
`xen` SUSE:Linux Enterprise Server 12 SP2-LTSS	All versions	`4.7.6_04-43.39.1`
`xen` SUSE:Linux Enterprise Server 12 SP3	All versions	`4.9.2_10-3.41.1`
`xen` SUSE:Linux Enterprise Server 12-LTSS	All versions	`4.4.4_36-22.74.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`4.4.4_36-61.37.2`
`xen` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`4.5.5_26-22.55.2`
`xen` SUSE:Linux Enterprise Server for SAP Applications 12 SP2	All versions	`4.7.6_04-43.39.1`
`xen` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`4.9.2_10-3.41.1`
`xen` SUSE:Linux Enterprise Software Development Kit 11 SP4	All versions	`4.4.4_36-61.37.2`
`xen` SUSE:Linux Enterprise Software Development Kit 12 SP3	All versions	`4.9.2_10-3.41.1`
`xen` SUSE:OpenStack Cloud 7	All versions	`4.7.6_04-43.39.1`

Products include Intel Core I3, Intel Core I5, Intel Core I7, Intel Core M, Intel Core M3, Intel Core M5 and 2 more.

How do I fix CVE-2018-3646?

Apply the vendor's patch.

Is CVE-2018-3646 being exploited?

There is no known exploitation of CVE-2018-3646 in the wild and no public exploit code.

Sources

Also known as ALPINE-CVE-2018-3646, DEBIAN-CVE-2018-3646, GHSA-qj7r-58vw-6www, SUSE-SU-2018:2394-1, SUSE-SU-2018:2401-1, SUSE-SU-2018:2409-1 and 8 more.