Medium 4.7Published Nov 15, 2018

CVE-2018-5407Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Updated under an hour ago (2026-10-19 08:40 UTC)

Does this affect you?

It affects canonical ubuntu_linux and 19 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for canonical ubuntu_linux

Exploited in the last 30 days

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

CVSS: 4.7 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-200
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: certcc
NVD analysis: Modified
Record last updated: Oct 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

canonical ubuntu_linux canonical:ubuntu_linux	14.04; 16.04; 18.04; 18.10	NVD
debian debian_linux debian:debian_linux	8.0; 9.0	NVD
nodejs node.js nodejs:node.js	before 6.14.4; from 8.0.0 before 8.11.4; from 10.0.0 before 10.9.0	NVD
openssl openssl openssl:openssl	from 1.0.2 before 1.0.2q; from 1.1.0 before 1.1.0i	NVD
tenable nessus tenable:nessus	before 8.1.1	NVD
oracle api_gateway oracle:api_gateway	11.1.2.4.0	NVD
oracle application_server oracle:application_server	0.9.8; 1.0.0; 1.0.1	NVD
oracle enterprise_manager_base_platform oracle:enterprise_manager_base_platform	12.1.0.5.0; 13.2.0.0.0; 13.3.0.0.0	NVD
oracle enterprise_manager_ops_center oracle:enterprise_manager_ops_center	12.3.3	NVD
oracle mysql_enterprise_backup oracle:mysql_enterprise_backup	through 3.12.3; from 3.12.4 through 4.1.2	NVD
oracle peoplesoft_enterprise_peopletools oracle:peoplesoft_enterprise_peopletools	8.55; 8.56; 8.57	NVD
oracle primavera_p6_enterprise_project_portfolio_management oracle:primavera_p6_enterprise_project_portfolio_management	from 17.7 through 17.12; 8.4; 15.1; 15.2; 16.1; 16.2; 18.8	NVD
oracle tuxedo oracle:tuxedo	12.1.1.0.0	NVD
oracle vm_virtualbox oracle:vm_virtualbox	before 6.0.0	NVD
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop	7.0	NVD
redhat enterprise_linux_server redhat:enterprise_linux_server	7.0; 7.6	NVD
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus	7.6	NVD
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus	7.6	NVD
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus	7.6	NVD
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation	7.0	NVD

References

https://access.redhat.com/errata/RHSA-2019:0483vendor-advisory, x-refsource-redhat
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlx-refsource-confirm
https://security.netapp.com/advisory/ntap-20181126-0001/x-refsource-confirm
https://usn.ubuntu.com/3840-1/vendor-advisory, x-refsource-ubuntu
https://www.debian.org/security/2018/dsa-4355vendor-advisory, x-refsource-debian
https://www.tenable.com/security/tns-2018-17x-refsource-confirm
https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/x-refsource-confirm
https://security.gentoo.org/glsa/201903-10vendor-advisory, x-refsource-gentoo
https://www.tenable.com/security/tns-2018-16x-refsource-confirm
https://www.exploit-db.com/exploits/45785/exploit, x-refsource-exploit-db
https://lists.debian.org/debian-lts-announce/2018/11/msg00024.htmlmailing-list, x-refsource-mlist
https://github.com/bbbrumley/portsmashx-refsource-misc
https://www.debian.org/security/2018/dsa-4348vendor-advisory, x-refsource-debian
http://www.securityfocus.com/bid/105897vdb-entry, x-refsource-bid
https://eprint.iacr.org/2018/1060.pdfx-refsource-misc
https://access.redhat.com/errata/RHSA-2019:0651vendor-advisory, x-refsource-redhat
https://access.redhat.com/errata/RHSA-2019:0652vendor-advisory, x-refsource-redhat
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx-refsource-misc
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx-refsource-misc
https://access.redhat.com/errata/RHSA-2019:2125vendor-advisory, x-refsource-redhat
https://support.f5.com/csp/article/K49711130?utm_source=f5support&amp%3Butm_medium=RSSx-refsource-confirm
https://access.redhat.com/errata/RHSA-2019:3929vendor-advisory, x-refsource-redhat
https://access.redhat.com/errata/RHSA-2019:3933vendor-advisory, x-refsource-redhat
https://access.redhat.com/errata/RHSA-2019:3931vendor-advisory, x-refsource-redhat
https://access.redhat.com/errata/RHSA-2019:3935vendor-advisory, x-refsource-redhat

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.