CVE-2018-5407

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-11-15 · updated 2026-10-08
Weakness: CWE-200

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
Debian Linux: 8.0, 9.0
Node.js: before 6.14.4; from 8.0.0 before 8.11.4; from 10.0.0 before 10.9.0 — fixed in 10.9.0, 6.14.4, 8.11.4
OpenSSL: from 1.0.2 before 1.0.2q; from 1.1.0 before 1.1.0i — fixed in 1.0.2q, 1.1.0i
Oracle Corporation API Gateway: 11.1.2.4.0
Oracle Application Server: 0.9.8, 1.0.0, 1.0.1
Oracle Corporation Enterprise Manager Base Platform: 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0
Oracle Corporation Enterprise Manager Ops Center: 12.3.3
Oracle Mysql Enterprise Backup: through 3.12.3; from 3.12.4 through 4.1.2
Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.55, 8.56, 8.57
Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 17.7 through 17.12; 8.4, 15.1, 15.2, 16.1, 16.2, 18.8
Oracle Corporation Tuxedo: 12.1.1.0.0
Oracle Corporation VM VirtualBox: before 6.0.0 — fixed in 6.0.0
RedHat Enterprise Linux Desktop: 7.0
RedHat Enterprise Linux Server: 7.0, 7.6
RedHat Enterprise Linux Server Aus: 7.6
RedHat Enterprise Linux Server Eus: 7.6
RedHat Enterprise Linux Server Tus: 7.6
RedHat Enterprise Linux Workstation: 7.0
Tenable Nessus: before 8.1.1 — fixed in 8.1.1

How to fix

Upgrade to a fixed version: Node.js 10.9.0, 6.14.4, 8.11.4; OpenSSL 1.0.2q, 1.1.0i; Oracle Corporation VM VirtualBox 6.0.0; Tenable Nessus 8.1.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-5407 or the next vulnerability affects your stack