Vulnerability record · CVE-2018-3639 · published 22 May 2018
CVE-2018-3639: Intel microprocessors speculative store bypass side-channel info disclosure
Intel · Atom C
CVE-2018-3639 is the Speculative Store Bypass (SSB) side-channel flaw, also called Variant 4, affecting Intel microprocessors that use speculative execution. A local attacker can observe timing differences to infer data that should not be readable, leaking information across privilege boundaries. It matters because the affected product list is broad and the flaw is a hardware design issue requiring microcode and OS-level fixes.
Description
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Automated analysis
medium priorityCVSS is medium (5.5) and exploitation requires local access, but the affected Intel product range is broad and EPSS is high.
What it is
CVE-2018-3639 is the Speculative Store Bypass (SSB) side-channel flaw, also called Variant 4, affecting Intel microprocessors that use speculative execution. A local attacker can observe timing differences to infer data that should not be readable, leaking information across privilege boundaries. It matters because the affected product list is broad and the flaw is a hardware design issue requiring microcode and OS-level fixes.
Impact
An attacker with local user access can disclose information from memory they are not authorized to read, via side-channel analysis. The CVSS vector shows confidentiality impact only, with no integrity or availability effect.
Attack surface
Reached locally on the affected system; the CVSS vector is AV:L with PR:L and UI:N, so the attacker needs local user access but no user interaction. No network vector is described.
Exploitation
CISA KEV does not list this CVE, but EPSS is high at 0.60631 (99.1st percentile), indicating elevated likelihood of exploitation activity. Reference tags are advisory and mailing-list entries, with no exploit tag present.
What to do
- Apply Intel microcode updates and the corresponding operating system, hypervisor and firmware patches for Speculative Store Bypass.
- Enable the SSB mitigation controls provided by the OS or hypervisor where available.
- Restrict local interactive access and limit untrusted code execution on affected hosts.
- Track vendor advisories from Red Hat, Lenovo, Fujitsu and Xen for the specific affected platforms.
- Retire or isolate systems that cannot receive microcode or OS mitigations.
Detection
- Monitor for local exploitation tooling or proof-of-concept code targeting speculative execution side channels.
- Audit hosts for missing microcode or kernel patches associated with Speculative Store Bypass.
- Review local user access and process execution on systems with sensitive data and affected CPUs.
- Correlate unusual local timing or cache-probing behavior with suspicious process activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Atom C Intel
Atom E Intel
Atom X5 E3930 Intel
Atom X5 E3940 Intel
Atom X7 E3950 Intel
Atom Z Intel
Celeron J Intel
Celeron N Intel
Core I3 Intel
Core I5 Intel
Core I7 Intel
Core M Intel
Pentium Intel
Pentium J Intel
Pentium Silver Intel
Xeon E 1105c Intel
Xeon E3 Intel
Xeon E3 1105c V2 Intel
Xeon E3 1125c V2 Intel
Xeon E3 1220 V2 Intel
Xeon E3 1220 V3 Intel
Xeon E3 1220 V5 Intel
Xeon E3 1220 V6 Intel
Xeon E3 12201 Intel
Xeon E3 12201 V2 Intel
Xeon E3 1220l V3 Intel
Xeon E3 1225 Intel
Xeon E3 1225 V2 Intel
Xeon E3 1225 V3 Intel
Xeon E3 1225 V5 Intel
Xeon E3 1225 V6 Intel
Xeon E3 1226 V3 Intel
Xeon E3 1230 Intel
Xeon E3 1230 V2 Intel
Xeon E3 1230 V3 Intel
Xeon E3 1230 V5 Intel
Xeon E3 1230 V6 Intel
Xeon E3 1230l V3 Intel
Xeon E3 1231 V3 Intel
Xeon E3 1235 Intel
Xeon E3 1235l V5 Intel
Xeon E3 1240 Intel
Xeon E3 1240 V2 Intel
Xeon E3 1240 V3 Intel
Xeon E3 1240 V5 Intel
Xeon E3 1240 V6 Intel
Xeon E3 1240l V3 Intel
Xeon E3 1240l V5 Intel
Xeon E3 1241 V3 Intel
Xeon E3 1245 Intel
Xeon E3 1245 V2 Intel
Xeon E3 1245 V3 Intel
Xeon E3 1245 V5 Intel
Xeon E3 1245 V6 Intel
Xeon E3 1246 V3 Intel
Xeon E3 1258l V4 Intel
Xeon E3 1260l Intel
Xeon E3 1260l V5 Intel
Xeon E3 1265l V2 Intel
Xeon E3 1265l V3 Intel
Xeon E3 1265l V4 Intel
Xeon E3 1268l V3 Intel
Xeon E3 1268l V5 Intel
Xeon E3 1270 Intel
Xeon E3 1270 V2 Intel
Xeon E3 1270 V3 Intel
Xeon E3 1270 V5 Intel
Xeon E3 1270 V6 Intel
Xeon E3 1271 V3 Intel
Xeon E3 1275 V2 Intel
Xeon E3 1275 V3 Intel
Xeon E3 1275 V5 Intel
Xeon E3 1275 V6 Intel
Xeon E3 1275l V3 Intel
Xeon E3 1276 V3 Intel
Xeon E3 1278l V4 Intel
Xeon E3 1280 Intel
Xeon E3 1280 V2 Intel
Xeon E3 1280 V3 Intel
Xeon E3 1280 V5 Intel
References
Track CVE-2018-3639 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-3639), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
