CVE-2018-5407

Published: Nov 15, 2018Modified: Jun 17, 2026

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.0 / Impact: 3.6

Source: NVD

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Affected (41)

Products: Canonical: Ubuntu Linux · Debian: Debian Linux · Nodejs: Node.js · +4 more

Show all products

1 product

1 product

1 product

1 product

1 product

9 products

Enterprise Manager Base Platform

Enterprise Manager Ops Center

Mysql Enterprise Backup

Peoplesoft Enterprise Peopletools

Primavera P6 Enterprise Project Portfolio Management

Tuxedo

Vm Virtualbox

Redhat

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 18.10

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	Before 6.14.4
Nodejs Node.js	From 10.0.0 to 10.9.0
Nodejs Node.js	From 8.0.0 to 8.11.4

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.2 to 1.0.2q
Openssl Openssl	From 1.1.0 to 1.1.0i

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Nessus	Before 8.1.1

Configuration F

22 vulnerable

Vulnerable Software	Affected Versions
Oracle Api Gateway	Version 11.1.2.4.0
Oracle Application Server	Version 0.9.8
Oracle Application Server	Version 1.0.0
Oracle Application Server	Version 1.0.1
Oracle Enterprise Manager Base Platform	Version 12.1.0.5.0
Oracle Enterprise Manager Base Platform	Version 13.2.0.0.0
Oracle Enterprise Manager Base Platform	Version 13.3.0.0.0
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Mysql Enterprise Backup	Up to 3.12.3
Oracle Mysql Enterprise Backup	From 3.12.4 to 4.1.2
Oracle Peoplesoft Enterprise Peopletools	Version 8.55
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Primavera P6 Enterprise Project Portfolio Management	From 17.7 to 17.12
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 15.1
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 15.2
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 16.1
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 16.2
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 18.8
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 8.4
Oracle Tuxedo	Version 12.1.1.0.0
Oracle Vm Virtualbox	Before 6.0.0

Configuration G

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server	Version 7.6
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Eus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CWE-203

Observable Discrepancy

The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (56)

http://www.securityfocus.com/bid/105897

Source: cret@cert.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2019:0483

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0651

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0652

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2125

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3929

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3931

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3932

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3933

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3935

Source: cret@cert.org

Third Party Advisory

https://eprint.iacr.org/2018/1060.pdf

Source: cret@cert.org

Technical DescriptionThird Party Advisory

https://github.com/bbbrumley/portsmash

Source: cret@cert.org

ExploitThird Party Advisory

https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html

Source: cret@cert.org

Mailing ListThird Party Advisory

https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/

Source: cret@cert.org

Third Party Advisory

https://security.gentoo.org/glsa/201903-10

Source: cret@cert.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20181126-0001/

Source: cret@cert.org

Third Party Advisory

https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS

Source: cret@cert.org

https://usn.ubuntu.com/3840-1/

Source: cret@cert.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4348

Source: cret@cert.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4355

Source: cret@cert.org

Third Party Advisory

https://www.exploit-db.com/exploits/45785/

Source: cret@cert.org

ExploitThird Party AdvisoryVDB Entry

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cret@cert.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cret@cert.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: cret@cert.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: cret@cert.org

PatchVendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: cret@cert.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2018-16

Source: cret@cert.org

Third Party Advisory

https://www.tenable.com/security/tns-2018-17

Source: cret@cert.org

Third Party Advisory

http://www.securityfocus.com/bid/105897