CVE-2018-5407: Infoleak
A flaw was found in microprocessor execution engine sharing on SMT (e.g. Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process, can extract certain secret information.
The reporter is able to steal an OpenSSL (<= 1.1.0h) P-384 private key from a TLS server using this new side-channel vector. It is a local attack in the sense that the malicious process must be running on the same physical core as the victim (an openSSL-powered TLS server in this case). But in general any application which branches on a secret value may be affected.
References: https://seclists.org/oss-sec/2018/q4/123
Other sources
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2018-5407?
CVE-2018-5407 is a vulnerability related to Simultaneous Multi-threading (SMT) in processors that can enable local users to exploit software vulnerabilities.
How does CVE-2018-5407 affect processors?
CVE-2018-5407 affects multiple SMT/Hyper-Threading architectures and processors, allowing a local attacker to obtain sensitive information.
What is the severity of CVE-2018-5407?
The severity of CVE-2018-5407 is medium, with a severity value of 5.1.
How can an attacker exploit CVE-2018-5407?
An attacker can exploit CVE-2018-5407 by using the PortSmash side-channel attack to run a malicious process next to a legitimate one on Simultaneous Multithreading (SMT) architecture.
Which software is affected by CVE-2018-5407?
The affected software includes OpenSSL, Node.js, Tenable Nessus, Oracle products, IBM Cloud Pak System, Redhat Enterprise Linux, and others. Please refer to the references for more details and specific versions.