CVE-2025-66442

Katalog CVE

CVSS 5.1 · Medium EPSS 0,27%

Kerentanan Covert Timing Channel pada arm mbed tls, arm tf-psa-crypto. Skor CVSS 3.1 5.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) that only occurs with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

Rincian

Terbit di NVD

1 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-385: Covert Timing Channel

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://mbed-tls.readthedocs.io/en/latest/security-advisories/ advisory vendor
• https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induc... advisory vendor
• https://github.com/Mbed-TLS/TF-PSA-Crypto/releases release notes
• https://github.com/Mbed-TLS/mbedtls/releases release notes