OpenSSL: non-constant-time SM2 point multiplication on AArch64 and RISC-V leaks key bits via timing and cache

Impact

The optimized SM2 scalar multiplication used on ARM64 and RISC-V branches and indexes tables according to secret bits, so execution time and cache-line access depend on the long-term private key during SM2 decryption and on the per-signature nonce during signing. An attacker co-resident on the same physical host - a neighbouring tenant on an Arm-based head node or Grace-class GPU server - who can time or observe cache behaviour of those operations can recover information about the secret scalar. Practical only where SM2 is actually in use, which for most operators is nowhere; TLS with ECDSA/RSA and the FIPS module are unaffected. Treat this as relevant if you run SM2 certificates or a Chinese-market cryptographic profile on Arm or RISC-V hardware.

Who can reach it

An attacker able to measure timing of, or observe cache-line access patterns for, SM2 signing or decryption on an affected AArch64 or RISC-V host - in practice local or co-resident on the machine performing the SM2 operation. No credentials on the target service are stated as required.

What to do

Upgrade OpenSSL: 4.0 users to 4.0.3, 3.6 to 3.6.5, 3.5 to 3.5.9, 3.4 to 3.4.8. OpenSSL 3.0, 1.1.1 and 1.0.2 are not affected. Distro packages are the usual path; every daemon linked against the shared library has to be restarted (or the node rebooted) before the new code is in use - no firmware or node drain needed. Statically linked appliances and containers need rebuilt images.

References

Related entries

• OpenSSH: heap out-of-bounds read during GSSAPI indicator cleanup crashes the authentication pathCVE-2026-55654 · OpenSSH sshd (GSSAPI auth-indicator cleanup)Low
• strongSwan: PKCS#7 certificate enumeration in the openssl plugin leaks memoryCVE-2026-78124 · strongSwan openssl plugin (PKCS#7 certificate enumeration)Low
• OpenSSH ssh client: control characters in untrusted usernames can execute commands via ProxyCommandCVE-2025-61984 · OpenSSH ssh client (control characters in usernames reaching ProxyCommand)Low
• OpenSSH ssh client: NUL byte in an ssh:// URI can execute commands via ProxyCommandCVE-2025-61985 · OpenSSH ssh client (NUL byte in ssh:// URI reaching ProxyCommand)Low
• OpenSSH sshd: the value "none" is sometimes treated as a filename instead of disabling the featureCVE-2026-106587 · OpenSSH sshd (configuration option value "none")Low
• OpenSSH ssh-agent: locking bypass lets a forwarded remote session add tokens and use keysCVE-2026-73281 · OpenSSH ssh-agent (agent locking vs session-bind@openssh.com extension)Low