CVE-2018-5407 Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
MediumCVSS 4.7
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 1.1.1~~pre9-1 | 1.1.1~~pre9-1 |
| debian/openssl(Debian:13) | < 1.1.1~~pre9-1 | 1.1.1~~pre9-1 |
| debian/openssl(Debian:14) | < 1.1.1~~pre9-1 | 1.1.1~~pre9-1 |
| alpine/openssl(Alpine:v3.3) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| alpine/openssl(Alpine:v3.4) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| alpine/openssl(Alpine:v3.5) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| alpine/openssl(Alpine:v3.6) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| alpine/openssl(Alpine:v3.7) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| alpine/openssl(Alpine:v3.8) | >= 1.0.2, < 1.0.2q-r0 | 1.0.2q-r0 |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.10 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| nodejs node.js | < 6.14.4 | 6.14.4 |
| nodejs node.js | >= 8.0.0, < 8.11.4 | 8.11.4 |
| nodejs node.js | >= 10.0.0, < 10.9.0 | 10.9.0 |
| OpenSSL | >= 1.0.2, < 1.0.2q | 1.0.2q |
| OpenSSL | >= 1.1.0, < 1.1.0i | 1.1.0i |
| tenable Nessus | < 8.1.1 | 8.1.1 |
| oracle api gateway | = 11.1.2.4.0 | No fix listed |
| oracle application server | = 0.9.8 | No fix listed |
| oracle application server | = 1.0.0 | No fix listed |
| oracle application server | = 1.0.1 | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle enterprise manager base platform | = 12.1.0.5.0 | No fix listed |
| oracle enterprise manager base platform | = 13.2.0.0.0 | No fix listed |
| oracle enterprise manager base platform | = 13.3.0.0.0 | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle mysql enterprise backup | <= 3.12.3 | No fix listed |
| oracle mysql enterprise backup | >= 3.12.4, <= 4.1.2 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.55 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.56 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.57 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | >= 17.7, <= 17.12 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 8.4 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 15.1 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 15.2 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 16.1 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 16.2 | No fix listed |
| oracle primavera p6 enterprise project portfolio management | = 18.8 | No fix listed |
| oracle tuxedo | = 12.1.1.0.0 | No fix listed |
| oracle vm virtualbox | < 6.0.0 | 6.0.0 |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-5407 vendor-advisory
- security.alpinelinux.org vendor-advisory
- RHSA-2019:0483 third-party-advisory vendor-advisory
- www.oracle.com patch vendor-advisory
- security.netapp.com third-party-advisory
- USN-3840-1 third-party-advisory vendor-advisory
- DSA-4355 third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- nodejs.org third-party-advisory
- GLSA-201903-10 third-party-advisory vendor-advisory
- www.tenable.com third-party-advisory
- 45785 exploit third-party-advisory vdb-entry
- [debian-lts-announce] 20181121 [SECURITY] [DLA 1586-1] openssl security update mailing-list third-party-advisory
- github.com exploit third-party-advisory
- DSA-4348 third-party-advisory vendor-advisory
- 105897 third-party-advisory vdb-entry
- eprint.iacr.org technical-description third-party-advisory
- RHSA-2019:0651 third-party-advisory vendor-advisory
- RHSA-2019:0652 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- RHSA-2019:2125 third-party-advisory vendor-advisory
- support.f5.com
- RHSA-2019:3929 third-party-advisory vendor-advisory
- RHSA-2019:3933 third-party-advisory vendor-advisory
- RHSA-2019:3931 third-party-advisory vendor-advisory
- RHSA-2019:3935 third-party-advisory vendor-advisory
- RHSA-2019:3932 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory