Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2025-66442

Опубликовано: 01 апр. 2026
Источник: redhat
CVSS3: 5.9
EPSS Низкий

Описание

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

A flaw was found in Mbed TLS and TF-PSA-Crypto. This vulnerability is a compiler-induced timing side channel that occurs when the LLVM compiler's select-optimize feature is enabled. A remote attacker could potentially exploit this timing difference during RSA and CBC/ECB decryption operations to infer sensitive information, such as cryptographic keys.

Отчет

This Moderate impact flaw in Mbed TLS and TF-PSA-Crypto is a compiler-induced timing side channel. When the LLVM compiler's select-optimize feature is enabled, a remote attacker could potentially exploit timing differences during RSA and CBC/ECB decryption operations to infer sensitive information, such as cryptographic keys. This affects Red Hat community projects such as Fedora and EPEL.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-733
https://bugzilla.redhat.com/show_bug.cgi?id=2453969mbedtls: Mbed TLS and TF-PSA-Crypto: Information disclosure via compiler-induced timing side channel

EPSS

Процентиль: 4%
0.00016
Низкий

5.9 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.1
ubuntu
3 дня назад

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

CVSS3: 5.1
nvd
4 дня назад

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

CVSS3: 5.1
debian
4 дня назад

In Mbed TLS through 4.0.0, there is a compiler-induced timing side cha ...

CVSS3: 5.1
github
4 дня назад

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

EPSS

Процентиль: 4%
0.00016
Низкий

5.9 Medium

CVSS3

Уязвимость CVE-2025-66442