A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.

Mitigation

At this time Red Hat Engineering is working on patches for openssl package in Red Hat Enterprise Linux 7 to address this issue. Until fixes are available, users are advised to review the guidance supplied in the L1 Terminal Fault vulnerability article: <https://access.redhat.com/security/vulnerabilities/L1TF> and decide what their exposure across shared CPU threads are and act accordingly.

References

bugzilla.redhat.com/show_bug.cgi?id=1645695

www.cve.org/CVERecord?id=CVE-2018-5407 https://nvd.nist.gov/vuln/detail/CVE-2018-5407 https://github.com/bbbrumley/portsmash https://www.openssl.org/news/secadv/20181112.txt

freebsd 2

oraclelinux 5

hp 1

cvelist 1

veracode 1

nessus 60

ibm 40

exploitpack 1

zdt 1

cve 1

nvd 1

openvas 34