CVE-2018-5407
MEDIUM
4.7
CVSS Score
Published: November 15, 2018 at 09:00 PM UTC
Updated: October 8, 2026 at 10:16 PM UTC
20 products affected across 7 vendorsDebian LinuxUbuntu LinuxEnterprise Linux Desktop
Using Processors supporting Simultaneous Multi-Threading by N/A?
Get instant alerts when new vulnerabilities affect Processors supporting Simultaneous Multi-Threading - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM4.7
Exploit prediction
EPSS 3%
SSVC
No known exploit
Description
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Ubuntu Linux· Canonicalrubygems
95%Debian Linux· Debiandrupal
95%v < 6.14.410.0.0 ≤ v < 10.9.08.0.0 ≤ v < 8.11.4*
Affected range stops below 10.9.0, so it looks safe — our inference, not a vendor statement
Affected range stops below 6.14.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 8.11.4, so it looks safe — our inference, not a vendor statement
1.0.2 ≤ v < 1.0.2q1.1.0 ≤ v < 1.1.0i*
Affected range stops below 1.0.2q, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.1.0i, so it looks safe — our inference, not a vendor statement
v ≤ 3.12.33.12.4 ≤ v ≤ 4.1.2*
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (28)
VDB Entryx_refsource_BIDThird Party Advisory
Source: [email protected]
http://www.securityfocus.com/bid/105897Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0483Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0651Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:0652Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:2125Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3929Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3931Vendor Advisoryx_refsource_REDHATThird Party Advisory
Source: [email protected]
https://access.redhat.com/errata/RHSA-2019:3932SSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- HIGH
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-200CWE-203
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card