OpenSSL up to 3.2.5/3.3.4/3.4.2/3.5.3 on 64-bit ARM SM2 covert timing channel

Summaryinfo

A vulnerability classified as critical has been found in OpenSSL up to 3.2.5/3.3.4/3.4.2/3.5.3 on 64-bit ARM. This vulnerability affects unknown code of the component SM2 Handler. This manipulation causes covert timing channel. This vulnerability is registered as CVE-2025-9231. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in OpenSSL up to 3.2.5/3.3.4/3.4.2/3.5.3 on 64-bit ARM. Affected by this vulnerability is some unknown processing of the component SM2 Handler. The manipulation with an unknown input leads to a covert timing channel vulnerability. The CWE definition for the vulnerability is CWE-385. Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information. As an impact it is known to affect confidentiality. The summary by CVE is:

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.

It is possible to read the advisory at openssl-library.org. This vulnerability is known as CVE-2025-9231 since 08/20/2025. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/21/2026).

The vulnerability scanner Nessus provides a plugin with the ID 266357 (Debian dsa-6015 : libcrypto3-udeb - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.2.6, 3.3.5, 3.4.3 or 3.5.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (266357), EUVD (EUVD-2025-31728) and CERT Bund (WID-SEC-2025-2166). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• IBM VIOS
• IBM AIX
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• IBM Power Hardware Management Console
• Red Hat Enterprise Linux
• Fedora Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• IBM App Connect Enterprise
• IBM TXSeries
• IBM MQ
• F5 BIG-IP
• IGEL OS
• Open Source OpenSSL
• Open Source LibreSSL
• Dell Secure Connect Gateway
• IBM DevOps Code ClearCase
• Meinberg LANTIME
• Splunk Splunk Enterprise
• SolarWinds Platform
• Red Hat OpenShift
• Xerox FreeFlow Print Server

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.3.0
• 3.3.1
• 3.3.2
• 3.3.3
• 3.3.4
• 3.4.0
• 3.4.1
• 3.4.2
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion