CVE-2018-3640: arm cortex-a Observable Discrepancy
Vulnerability summary
CVE-2018-3640 is a medium (CVSS 5.6) Observable Discrepancy vulnerability in arm cortex-a. EPSS estimates a 7.14% chance of exploitation in the next 30 days, higher than 94.2% of scored vulnerabilities.
Not severe (CVSS 5.6, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 15 · Related 11Timeline
- 22-05-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Systems with microprocessors utilizing speculative execution and that perform speculative reads of system registers may allow unauthorized disclosure of system parameters to an attacker with local user access via a side-channel analysis, aka Rogue System Register Read (RSRE), Variant 3a.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.6MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
7.14%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Decrease -0.32 pp
From 7.46% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Intel196 products
- atom_cc2308 | c3308 | c3338 | c3508 | c3538 | c3558 | c3708 | c3750 | c3758 | c3808 | c3830 | c3850 | c3858 | c3950 | c3955 | c3958
- atom_ee3805 | e3815 | e3825 | e3826 | e3827 | e3845
- atom_zz2420 | z2460 | z2480 | z2520 | z2560 | z2580 | z2760 | z3460 | z3480 | z3530 | z3560 | z3570 | z3580 | z3590 | z3735d | z3735e | z3735f | z3735g | z3736f | z3736g | z3740 | z3740d | z3745 | z3745d | z3770 | z3770d | z3775 | z3775d | z3785 | z3795
- celeron_jj3455 | j4005 | j4105
- celeron_nn3450
Arm1 product
- cortex-a15 | 57 | 72
Debian1 product
- intel-microcode< 3.20180703.1
Intel corporation1 product
- multipleMultiple
Ubuntu1 product
- intel-microcode< 3.20180807a.0ubuntu0.14.04.1 | < 3.20180807a.0ubuntu0.16.04.1 | < 3.20180807a.0ubuntu0.18.04.1
5 vendors · 200 products · Showing 200 of 202
References
26 links- cert-portal.siemens.com/productcert/pdf/ssa-268644.pdfX Refsource CONFIRM
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0005X Refsource CONFIRM
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.htmlX Refsource CONFIRMVendor AdvisoryREPORT
- developer.arm.com/support/arm-security-updates/speculative-processor-vulnerabilityX Refsource CONFIRMVendor Advisory
Show all 26 references
- www.fujitsu.com/global/support/products/software/security/products-f/cve-2018-3639e.htmlX Refsource CONFIRMThird Party Advisory
portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV180013X Refsource CONFIRMPatchThird Party AdvisoryVendor Advisory- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180521-cpusidechannelVendor AdvisoryX Refsource CISCOThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03850en_usX Refsource CONFIRMThird Party Advisory
- cert-portal.siemens.com/productcert/pdf/ssa-608355.pdfX Refsource CONFIRM