Vulnerability Description
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 8.0 |
| Nodejs | Node.Js | < 6.14.4 |
| Openssl | Openssl | >= 1.0.2, < 1.0.2q |
| Tenable | Nessus | < 8.1.1 |
| Oracle | Api Gateway | 11.1.2.4.0 |
| Oracle | Application Server | 0.9.8 |
| Oracle | Enterprise Manager Base Platform | 12.1.0.5.0 |
| Oracle | Enterprise Manager Ops Center | 12.3.3 |
| Oracle | Mysql Enterprise Backup | <= 3.12.3 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.55 |
| Oracle | Primavera P6 Enterprise Project Portfolio Management | >= 17.7, <= 17.12 |
| Oracle | Tuxedo | 12.1.1.0.0 |
| Oracle | Vm Virtualbox | < 6.0.0 |
| Redhat | Enterprise Linux Desktop | 7.0 |
| Redhat | Enterprise Linux Server | 7.0 |
| Redhat | Enterprise Linux Server Aus | 7.6 |
| Redhat | Enterprise Linux Server Eus | 7.6 |
| Redhat | Enterprise Linux Server Tus | 7.6 |
| Redhat | Enterprise Linux Workstation | 7.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/105897Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2019:0483Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0651Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0652Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2125Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3929Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3931Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory
- https://eprint.iacr.org/2018/1060.pdfTechnical DescriptionThird Party Advisory
- https://github.com/bbbrumley/portsmashExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00024.htmlMailing ListThird Party Advisory
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/Third Party Advisory
- https://security.gentoo.org/glsa/201903-10Third Party Advisory
FAQ
What is CVE-2018-5407?
CVE-2018-5407 is a vulnerability with a CVSS score of 4.7 (MEDIUM). Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
How severe is CVE-2018-5407?
CVE-2018-5407 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-5407?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Debian Debian Linux, Nodejs Node.Js, Openssl Openssl, Tenable Nessus.