CVE-2025-52496

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

Root has patched CVE-2025-52496 in the mbedtls package for Root:Debian:12. Multiple fixed versions available.

Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a multithreaded program, or perform a GCM forgery.

These are all security issues fixed in the libmbedcrypto7-2.28.10-5.1 package on the GA media of openSUSE Tumbleweed.

This update for mbedtls fixes the following issues:

Changes in mbedtls:

• Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the 3.6.2-3.6.6 releases:
  • CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
  • CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
  • CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
  • CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
  • CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
  • CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
  • CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
  • CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
  • CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
  • CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
  • CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
  • CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
  • CVE-2026-25833: PSA RNG state duplicated across fork()
  • CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
  • CVE-2026-25835: RNG state duplicated when application/VM state is cloned

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

• CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs (boo#1245810)
• CVE-2025-59438: padding oracle through timing of cipher error reporting (boo#1252454)

It was discovered that Mbed TLS incorrectly handled memory allocation failures. A remote attacker could possibly use this issue to crash the program. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-44732)

Jonathan Winzig discovered that Mbed TLS incorrectly handled crafted inputs. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS. (CVE-2024-23775)

It was discovered that Mbed TLS incorrectly handled the TLS handshake. A remote attacker could possibly use this issue to break the security guarantees of the TLS handshake. (CVE-2025-27810)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly documented the behavior of a function. Application code relying on the documented behavior might be affected. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2025-47917)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled crafted input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-48965)

It was discovered that Mbed TLS incorrectly handled a race condition. An attacker could possibly use this issue to extract AES keys. (CVE-2025-52496)

Linh Le and Ngan Nguyen discovered that Mbed TLS incorrectly handled certain invalid input. A remote attacker could possibly use this issue to crash the program, resulting in a denial of service. (CVE-2025-52497)