CVE-2018-5407

MEDIUM

Ubuntu Linux - Exposure of Sensitive Information via SMT Port Contention Timing Attack

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-5407. PoCs published by Billy Brumley.

AI-analyzed exploit summary This is a proof-of-concept exploit for the PortSmash microarchitecture attack (CVE-2018-5407), targeting OpenSSL 1.1.0h or lower. It leverages SMT (Simultaneous Multithreading) to extract cryptographic keys by monitoring execution traces.

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

Exploits (1)

exploitdb WORKING POC
by Billy Brumley · localhardware
https://www.exploit-db.com/exploits/45785

This is a proof-of-concept exploit for the PortSmash microarchitecture attack (CVE-2018-5407), targeting OpenSSL 1.1.0h or lower. It leverages SMT (Simultaneous Multithreading) to extract cryptographic keys by monitoring execution traces.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Complex
Reliability
Theoretical
Target: OpenSSL 1.1.0h or lower
No auth needed
Prerequisites: CPU with SMT (e.g., Hyper-Threading) · OpenSSL 1.1.0h or lower installed
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (28)

Core 28
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0483
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20181126-0001/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3840-1/
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4355
Third Party Advisory x_refsource_confirm
https://www.tenable.com/security/tns-2018-17
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201903-10
Third Party Advisory x_refsource_confirm
https://www.tenable.com/security/tns-2018-16
Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/45785/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html
Exploit, Third Party Advisory x_refsource_misc
https://github.com/bbbrumley/portsmash
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4348
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105897
Technical Description, Third Party Advisory x_refsource_misc
https://eprint.iacr.org/2018/1060.pdf
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0651
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:0652
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:2125
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3929
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3933
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3931
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3935
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2019:3932
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2020.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2020.html

Scores

CVSS v3 4.7
EPSS 0.0342
EPSS Percentile 87.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200 CWE-203
Status published
Products (37)
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
debian/debian_linux 8.0
debian/debian_linux 9.0
nodejs/node.js < 6.14.4
openssl/openssl 1.0.2 - 1.0.2q
oracle/api_gateway 11.1.2.4.0
oracle/application_server 0.9.8
... and 27 more
Published Nov 15, 2018
Tracked Since Feb 18, 2026