CVE-2018-5407
N/A Processors supporting Simultaneous Multi-Threading
MEDIUM 4.7
En bref
- Source
- NVD
- EPSS
- EPSS 3.42 % · centile 89 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- certcc
- Statut NVD
- Modified
Description
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
- CWE-203 — Écart observable
Références
- https://access.redhat.com/errata/RHSA-2019:0483
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://security.netapp.com/advisory/ntap-20181126-0001/
- https://usn.ubuntu.com/3840-1/
- https://www.debian.org/security/2018/dsa-4355
- https://www.tenable.com/security/tns-2018-17
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
- https://security.gentoo.org/glsa/201903-10
- https://www.tenable.com/security/tns-2018-16
- https://www.exploit-db.com/exploits/45785/
- https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html
- https://github.com/bbbrumley/portsmash
- https://www.debian.org/security/2018/dsa-4348
- http://www.securityfocus.com/bid/105897
- https://eprint.iacr.org/2018/1060.pdf
- https://access.redhat.com/errata/RHSA-2019:0651
- https://access.redhat.com/errata/RHSA-2019:0652
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://access.redhat.com/errata/RHSA-2019:2125
- https://support.f5.com/csp/article/K49711130?utm_source=f5support&%3Butm_medium=RSS
- https://access.redhat.com/errata/RHSA-2019:3929
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3931
- https://access.redhat.com/errata/RHSA-2019:3935
- https://access.redhat.com/errata/RHSA-2019:3932
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-17177
- GCVE · GCVE-0-2018-5407
Avis du CERT-FR
- CERTFR-2022-AVI-267 — Multiples vulnérabilités dans Juniper Networks Junos Space · cert.ssi.gouv.fr
- CERTFR-2019-AVI-242 — Multiples vulnérabilités dans F5 BIG-IP · cert.ssi.gouv.fr
- CERTFR-2019-AVI-023 — Multiples vulnérabilités dans Oracle Sun Systems · cert.ssi.gouv.fr
- CERTFR-2018-AVI-607 — Multiples vulnérabilités dans Tenable Nessus · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*< 6.14.4cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.11.4cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*≥ 10.0.0 < 10.9.0cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.0.2 < 1.0.2qcpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.1.0 < 1.1.0icpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*< 8.1.1cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_server:0.9.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_server:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_server:1.0.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*≤ 3.12.3cpe:2.3:a:oracle:mysql_enterprise_backup:*:*:*:*:*:*:*:*≥ 3.12.4 ≤ 4.1.2cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*≥ 17.7 ≤ 17.12cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:8.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:15.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.1:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:16.2:*:*:*:*:*:*:*cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:18.8:*:*:*:*:*:*:*cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:vm_virtualbox:*:*:*:*:*:*:*:*< 6.0.0cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*- +1 autres
Produits affectés
| Produit | Versions |
|---|---|
| N/A · Processors supporting Simultaneous Multi-Threading | affected N/A |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |