CVE-2018-5407

Опубликовано: 15 нояб. 2018

Источник: nvd

CVSS3: 4.7

CVSS2: 1.9

EPSS Низкий

Описание

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Ссылки

http://www.securityfocus.com/bid/105897
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2019:0483
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0651
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0652
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2125
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3929
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3931
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3932
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3933
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3935
Third Party Advisory
https://eprint.iacr.org/2018/1060.pdf
Technical Description
Third Party Advisory
https://github.com/bbbrumley/portsmash
Exploit
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html
Mailing List
Third Party Advisory
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Third Party Advisory
https://security.gentoo.org/glsa/201903-10
Third Party Advisory
https://security.netapp.com/advisory/ntap-20181126-0001/
Third Party Advisory
https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSS
https://usn.ubuntu.com/3840-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4348
Third Party Advisory
https://www.debian.org/security/2018/dsa-4355
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Версия до 6.14.4 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Версия от 8.0.0 (включая) до 8.11.4 (исключая)

cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*

Версия от 10.0.0 (включая) до 10.9.0 (исключая)

Конфигурация 4

Одно из

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Версия от 1.0.2 (включая) до 1.0.2q (исключая)

cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Версия от 1.1.0 (включая) до 1.1.0i (исключая)

Конфигурация 5

cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*

Версия до 8.1.1 (исключая)

Конфигурация 6

Одно из

cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_server:0.9.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_server:1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:application_server:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*

Версия до 3.12.3 (включая)

cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*

Версия от 3.12.4 (включая) до 4.1.2 (включая)

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*

cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*

Версия от 17.7 (включая) до 17.12 (включая)

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*

Версия до 6.0.0 (исключая)

Конфигурация 7

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.00778

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-200

CWE-203

Связанные уязвимости

CVE-2018-5407

CVSS3: 4.7

ubuntu

больше 6 лет назад

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE-2018-5407

CVSS3: 4.8

redhat

больше 6 лет назад

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVE-2018-5407

CVSS3: 4.7

debian

больше 6 лет назад

Simultaneous Multi-threading (SMT) in processors can enable local user ...

GHSA-3rjg-j575-7f6p

CVSS3: 4.7

github

около 3 лет назад

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

ELSA-2019-0483

oracle-oval

больше 6 лет назад

ELSA-2019-0483: openssl security and bug fix update (MODERATE)

EPSS

Процентиль: 73%

0.00778

Низкий

4.7 Medium

CVSS3

1.9 Low

CVSS2

Дефекты

CWE-200

CWE-203