5.5

CVE-2018-3639: arm cortex-a Observable Discrepancy

Modified
AliasesALPINE-CVE-2018-3639MGASA-2018-0262MGASA-2018-0298
Published 22-05-2018Last modified 29-05-2026

Vulnerability summary

CVE-2018-3639 is a medium (CVSS 5.5) Observable Discrepancy vulnerability in arm cortex-a. EPSS estimates a 60.42% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
60.42%
0%100%
Critical · -0.21 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 93 · Related 64
DLA-1423-1DLA-1446-1DLA-1529-1DLA-1715-1DLA-1731-1DSA-4273-1

Timeline

  1. 22-05-2018
    PublishedVulnerability first disclosed.
  2. 29-05-2026
    Last modifiedVulnerability information updated.

Description

Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.

CVSS metrics

7 scores · 6 sources · 3 versions

EPSS trend

Probability

60.42%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Decrease -0.21 pp

From 60.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (bugs.chromium.org)

    Maturity: unknown

  • exploit-databasedoshardwareVerified

    AMD / ARM / Intel - Speculative Execution Variant 4 Speculative Store Bypass

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Intel171 products
Ubuntu19 products
  • intel-microcode< 3.20180807a.0ubuntu0.14.04.1 | < 3.20180807a.0ubuntu0.16.04.1 | < 3.20180807a.0ubuntu0.18.04.1
  • libvirt< 1.2.2-0ubuntu13.1.27 | < 1.3.1-1ubuntu10.24 | < 4.0.0-1ubuntu8.2
  • linux< 3.13.0-149.199 | < 4.4.0-127.153 | < 4.15.0-22.24
  • linux-aws< 4.4.0-1022.22 | < 4.4.0-1060.69 | < 4.15.0-1009.9
  • linux-azure< 4.13.0-1018.21 | < 4.15.0-1012.12
Debian5 products
  • arm-trusted-firmwareAll versions (No fix recorded) | < 2.12.16+dfsg-1
  • intel-microcode< 3.20180703.1
  • linux< 4.16.12-1
  • xen< 4.8.3+xsa262+shim4.10.0+comet3-1+deb9u7
  • debian_linuxEOL8.0 | 9.0
Alpine2 products
  • openjdk8< 8.181.13-r0
  • xen< 4.11.0-r0 | < 4.7.6-r0 | < 4.8.4-r0 | < 4.9.2-r3 | < 4.10.1-r3
Arm1 product
Canonical1 product
Intel corporation1 product

7 vendors · 200 products · Showing 200 of 559

References

300 links
Show all 100 references

Showing 100 of 300.