CVE-2025-9231 in OpenSSL
Summary
by MITRE • 09/30/2025
Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms.
Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker..
While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack.
OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue.
The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/21/2026
The vulnerability described in CVE-2025-9231 represents a timing side-channel attack against the SM2 elliptic curve digital signature algorithm implementation on 64-bit ARM platforms. This issue falls under the category of side-channel attacks where an adversary can infer sensitive information by analyzing the time taken to perform cryptographic operations. The SM2 algorithm, a Chinese national standard for digital signatures, is implemented within OpenSSL's cryptographic library, specifically affecting systems running on ARM64 architecture where timing variations in computation can reveal information about the private key being used. The vulnerability stems from the non-constant time execution of certain operations during signature generation, creating measurable differences in processing time that correlate with the private key bits.
The technical flaw manifests as a timing signal that emerges during SM2 signature computations, allowing an attacker to potentially reconstruct the private key through careful timing measurements. This type of vulnerability is particularly dangerous because it operates at the implementation level rather than targeting the mathematical foundations of the algorithm itself. The timing variations occur due to conditional branches or memory access patterns that differ based on the secret key values, creating observable time differences that can be exploited using statistical analysis techniques. This vulnerability is classified as a timing side-channel attack and maps to CWE-385 - Timing Attack, which specifically addresses situations where an attacker can infer information from the time taken to execute cryptographic operations. The attack vector is remote, meaning an adversary could potentially exploit this weakness from network locations without physical access to the target system.
The operational impact of this vulnerability extends beyond typical TLS contexts where SM2 certificates are not natively supported by OpenSSL. While the standard TLS implementation does not utilize SM2 keys, the vulnerability becomes significant when custom providers are implemented to support SM2 certificates, creating a scenario where remote attackers could potentially recover private keys from systems running these custom configurations. This represents a moderate severity issue because it requires specific conditions to be exploited - namely, the presence of a custom provider that enables SM2 certificate support and the ability to perform timing measurements against the target system. The vulnerability affects OpenSSL versions 3.5, 3.4, 3.3, 3.2, 3.1, and 3.0, but notably excludes FIPS modules in these versions as SM2 is not approved for use in FIPS-certified implementations. The attack requires sophisticated measurement capabilities and is not trivial to execute, but the potential for private key recovery makes it a serious concern for systems that may be configured to use SM2 with custom implementations.
Mitigation strategies for this vulnerability include updating to patched versions of OpenSSL where the timing side-channel has been addressed through constant-time implementation of the SM2 algorithm. Organizations should also consider disabling SM2 support in custom providers if it is not strictly required for their operations, particularly in environments where the risk of timing attacks cannot be adequately mitigated. Implementing additional countermeasures such as randomizing execution timing, using constant-time algorithms, and avoiding conditional branches that depend on secret data can help reduce the effectiveness of timing attacks. Security practitioners should also monitor for custom implementations that may introduce similar vulnerabilities and ensure that any custom cryptographic modules undergo thorough security testing including side-channel analysis. The ATT&CK framework categorizes this vulnerability under T1059.001 - Command and Scripting Interpreter: PowerShell and T1566 - Phishing, as attackers may use timing measurements as part of reconnaissance activities to identify vulnerable systems. Additionally, this vulnerability aligns with the NIST SP 800-57 guidelines for cryptographic key management and the ISO/IEC 14443 standard for secure cryptographic implementations, emphasizing the need for constant-time execution in cryptographic algorithms to prevent information leakage through side channels.