OpenSSL: timing side-channel in SM2 signing on 64-bit ARM may leak the private key

CVSS 5.9CVE-2025-9231Kernel, userspace & hypervisorcurated

Impact

SM2 signature computation on 64-bit ARM platforms shows a timing signal that may allow an attacker making repeated measurements to recover the private key. Reachability is narrow: OpenSSL does not support SM2 certificates in TLS, so the path only exists where an operator has added SM2 through a custom provider. For ARM-based GPU hosts (Grace-class nodes and ARM management processors) the practical question is whether anything in the stack signs with SM2 at all - if not, there is nothing to exploit. The reporter measured the timing signal but did not demonstrate remote key recovery, and the FIPS modules in 3.0 through 3.5 are unaffected because SM2 is not an approved algorithm.

Who can reach it

Remote, unauthenticated timing measurements against a service that performs SM2 signatures on 64-bit ARM; requires a custom provider wiring SM2 into the service.

What to do

Update OpenSSL to a release containing the referenced commits and restart the services linked against it. Before scheduling anything, confirm whether any service on your ARM nodes uses SM2 - with no SM2 provider in play this needs no urgency beyond normal patch cadence.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-9231 https://openssl-library.org/news/secadv/20250930.txt https://github.com/openssl/openssl/commit/567f64386e43683888212226824b6a179885a0fe https://github.com/openssl/openssl/commit/cba616c26ac8e7b37de5e77762e505ba5ca51698

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.