peter bassill · operator
$ cve CVE-2018-5407 JSON

CVE-2018-5407 EXPLOIT

4.7
MEDIUM · CVSS 3.1 · EPSS 3.4% (pctl 89)

Patch early

A public exploit exists.

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Scoring

CVSS4.7 (MEDIUM, v3.1)
VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS3.42% — more likely to be exploited than 89% of all CVEs
WeaknessCWE-200
On CISA KEVno
Public exploityes
Published2018-11-15
Last modified2026-06-17

Affected (20)

VendorProduct
canonicalubuntu linux
debiandebian linux
nodejsnode.js
opensslopenssl
oracleapi gateway
oracleapplication server
oracleenterprise manager base platform
oracleenterprise manager ops center
oraclemysql enterprise backup
oraclepeoplesoft enterprise peopletools
oracleprimavera p6 enterprise project portfolio management
oracletuxedo
oraclevm virtualbox
redhatenterprise linux desktop
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server eus
redhatenterprise linux server tus
redhatenterprise linux workstation
tenablenessus

Public exploits

SourceTitleDate
exploit-dbIntel (Skylake / Kaby Lake) - 'PortSmash' CPU SMT Side-Channel2018-11-02

References

→ the Explorer  ·  watch your stack  ·  NVD