HOMEVULNERABILITIESCVE-2005-0109
MEDIUM

CVE-2005-0109

NVD-CWE-OtherPublished: March 5, 2005· Updated: Jun 16, 2026

5.6
CVSS v3.1

Official Description

Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.

NVD Source

Technical Analysis

CVE-2005-0109 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 5.6.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityHigh
Privileges Req.Low
User InteractionNone
ScopeChanged
Impact
ConfidentialityHigh
IntegrityNone
AvailabilityNone
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected Vendors & Products

freebsd1 product(s)
freebsd
Red Hat3 product(s)
enterprise linuxenterprise linux desktopfedora core
sco2 product(s)
openserverunixware
sun1 product(s)
solaris
Ubuntu1 product(s)
ubuntu linux
Source: NVD CPE · 58 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

All References (36)

Quick Facts

CVE IDCVE-2005-0109
CVSS Score5.6 / 10
SeverityMEDIUM
CISA KEVNo
Affected5 vendor(s)
PublishedMar 5, 2005

Related CVEs (NVD-CWE-Other)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2005-0109 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.