CVE-2018-5407

MEDIUMMonitor

Published:Nov 15, 2018(7 years ago)

Modified:Nov 21, 2024

Local AccessNo Interaction

Vulnerability Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Attack Characteristics

Local AccessHigh ComplexityLow PrivilegesNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
canonical	ubuntu_linux	-	-
canonical	ubuntu_linux	-	-
canonical	ubuntu_linux	-

Timeline

Published
CVE disclosed publicly
Nov 15, 20187 years ago
Last Modified
Most recent update
Nov 21, 20241 year ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

http://www.securityfocus.com/bid/105897Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0483Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0651Third Party Advisory

CVSS Score

v3.1

4.7/ 10.0

MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

At a Glance

Affected Products

References

canonical / ubuntu_linux

https://access.redhat.com/errata/RHSA-2019:0652Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2125Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3929Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3931Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory

https://eprint.iacr.org/2018/1060.pdfTechnical Description

https://github.com/bbbrumley/portsmashExploit

https://lists.debian.org/debian-lts-announce/2018/11/msg00024.htmlMailing List

https://nodejs.org/en/blog/vulnerability/november-2018-security-releas...Third Party Advisory

https://security.gentoo.org/glsa/201903-10Third Party Advisory

https://security.netapp.com/advisory/ntap-20181126-0001/Third Party Advisory

https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%...

https://usn.ubuntu.com/3840-1/Third Party Advisory

https://www.debian.org/security/2018/dsa-4348Third Party Advisory

https://www.debian.org/security/2018/dsa-4355Third Party Advisory

https://www.exploit-db.com/exploits/45785/Exploit

https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch

https://www.oracle.com/security-alerts/cpujan2020.htmlPatch

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-507281...Patch

https://www.oracle.com/technetwork/security-advisory/cpujan2019-507280...Patch

https://www.oracle.com/technetwork/security-advisory/cpujul2019-507283...Patch

https://www.tenable.com/security/tns-2018-16Third Party Advisory

https://www.tenable.com/security/tns-2018-17Third Party Advisory

http://www.securityfocus.com/bid/105897Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0483Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0651Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0652Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2125Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3929Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3931Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory

https://eprint.iacr.org/2018/1060.pdfTechnical Description

https://github.com/bbbrumley/portsmashExploit

https://lists.debian.org/debian-lts-announce/2018/11/msg00024.htmlMailing List

https://nodejs.org/en/blog/vulnerability/november-2018-security-releas...Third Party Advisory

https://security.gentoo.org/glsa/201903-10Third Party Advisory

https://security.netapp.com/advisory/ntap-20181126-0001/Third Party Advisory

https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%...

https://usn.ubuntu.com/3840-1/Third Party Advisory

https://www.debian.org/security/2018/dsa-4348Third Party Advisory

https://www.debian.org/security/2018/dsa-4355Third Party Advisory

https://www.exploit-db.com/exploits/45785/Exploit

https://www.oracle.com/security-alerts/cpuapr2020.htmlPatch

https://www.oracle.com/security-alerts/cpujan2020.htmlPatch

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-507281...Patch

https://www.oracle.com/technetwork/security-advisory/cpujan2019-507280...Patch

https://www.oracle.com/technetwork/security-advisory/cpujul2019-507283...Patch

https://www.tenable.com/security/tns-2018-16Third Party Advisory

https://www.tenable.com/security/tns-2018-17Third Party Advisory

CVSS v3 Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability

Attack VectorLocal

Attack ComplexityHigh

Privileges RequiredLow

User InteractionNone

Impact

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

Impact Analysis

ConfidentialityHigh

NoneLowHigh

IntegrityNone

NoneLowHigh

AvailabilityNone

NoneLowHigh

CVE-2018-5407

✦ Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description