Security Bulletin: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash)

Summary

IBM MessageSight has addressed the following vulnerability. A microprocessor side-channel vulnerability was found. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information that can result in leakage of secret data in applications such as OpenSSL.

Vulnerability Details

CVEID: CVE-2018-5407
**DESCRIPTION:*Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on ‘port contention’.
CVSS Base Score: 5.1
CVSS Temporal Score: See [ https://exchange.xforce.ibmcloud.com/vulnerabilities/152484](< https://exchange.xforce.ibmcloud.com/vulnerabilities/152484&gt;) for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

OpenSSL 1.1.0 (fixed in 1.1.0i)

| [

OpenSSL Security Advisory

](<https://www.openssl.org/news/secadv/20181112.txt&gt;)

Workarounds and Mitigations

None