CVE-2018-5407

MEDIUM severity · CVSS 4.7 · Information disclosure

4.7CVSS MEDIUM

Summary

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Impact & exploitability

Attack vectorLocal

Attack complexityHigh

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products we track (2)

Node.js OpenSSL

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
http://www.securityfocus.com/bid/105897Advisory
https://access.redhat.com/errata/RHSA-2019:0483Advisory
https://access.redhat.com/errata/RHSA-2019:0651Advisory
https://access.redhat.com/errata/RHSA-2019:0652Advisory
https://access.redhat.com/errata/RHSA-2019:2125Advisory
https://access.redhat.com/errata/RHSA-2019:3929Advisory
https://access.redhat.com/errata/RHSA-2019:3931Advisory
https://access.redhat.com/errata/RHSA-2019:3932Advisory