CVEs-PoC/2018/CVE-2018-5407.md

CVE-2018-5407

Description

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.

POC

Reference

• https://github.com/bbbrumley/portsmash
• https://www.exploit-db.com/exploits/45785/
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• https://www.tenable.com/security/tns-2018-16
• https://www.tenable.com/security/tns-2018-17

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Yuning-J/PatchRank
• https://github.com/bbbrumley/portsmash
• https://github.com/codexlynx/hardware-attacks-state-of-the-art
• https://github.com/djschleen/ash
• https://github.com/mrodden/vyger
• https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance