CVE-2025-59438

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

Vulnerability

In symmetric encryption modes that involve padding, if an attacker can submit ciphertexts for decryption and learn whether the padding is valid, this provides partial information about the plaintext. If the attacker can also submit input that the victim encrypts together with a secret, this can allow the attacker to recover the whole secret part. This is known as a padding oracle attack. The attacker may learn the validity of the padding directly or indirectly, for example through timing.

In the Mbed TLS legacy API (mbedtls_cipher_crypt(), mbedtls_cipher_finish()), the problematic modes are ECB and CBC with any padding other than NONE. In the PSA Crypto API (psa_cipher_decrypt(), psa_cipher_finish()), the problematic algorithm is PSA_ALG_CBC_PKCS7.

Mbed TLS takes care to check the padding in constant time inside the legacy cipher modules, so mbedtls_cipher_crypt() and mbedtls_cipher_finish() are not vulnerable. However, application code may be vulnerable if it handles errors from these functions in a way that is not constant-time.

In the PSA API, when the built-in implementation of CBC-PKCS7 is used, the PSA functions (psa_cipher_decrypt(), psa_cipher_finish()) call mbedtls_cipher_finish() and translate its error codes into PSA error codes. This translation is not constant-time, and a local unprivileged attacker may be able to observe which error is raised by timing shared resources such as a code cache or a branch predictor.

In the PSA API, when using a driver, there is no error translation. However some code paths inside the library distinguish the error case from the success case, which allows the same attack.

Impact

Local attackers may be able to recover plaintexts encrypted with CBC-PKCS7 or other symmetric encryption mode using padding when it is decrypted through the PSA API.

Applications using the legacy API to decrypt with padding may be affected through their own error handling.

Affected versions

All versions of Mbed TLS up to 3.6.4 are affected.

TF-PSA-Crypto 1.0.0beta is also affected.

Work-around

Applications are not affected if they only accept authenticated ciphertexts for CBC decryption, i.e. if they only use CBC as part of an encrypt-then-MAC construction. (Applications should use AEAD modes instead of CBC-based modes whenever possible.)

Resolution

Affected users should upgrade to Mbed TLS 3.6.5 or TF-PSA-Crypto 1.0.0 or above.

Additionally, applications using mbedtls_cipher_crypt() or mbedtls_cipher_finish() with a CBC or EBC mode with padding should review their error handling, and should consider switching to the new function mbedtls_cipher_finish_padded() which simplifies the handling of invalid-padding conditions.

Applications doing decryption with PSA_ALG_CBC_PKCS7 should handle errors carefully if local timing attacks are a concern. (This also applies to asymmetric decryption with PSA_ALG_RSA_PKCS1V15_CRYPT.)

Mbed TLS through 3.6.4 has an Observable Timing Discrepancy.

These are all security issues fixed in the micropython-1.26.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libeverest-3.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for micropython fixes the following issues:

Changes in micropython:

• Build with mbedtls-3.6.5 instead of bundled 3.6.2 to fix CVE-2025-59438

Version 1.26.0:

• Added machine.I2CTarget for creating I2C target devices on multiple ports.
• New MCU support: STM32N6xx (800 MHz, ML accel) & ESP32-C2 (WiFi + BLE).
• Major float accuracy boost (~28% → ~98%), constant folding in compiler.
• Optimized native/Viper emitters; reduced heap use for slices.
• Time functions standardized (1970–2099); new boards across ESP32, SAMD, STM32, Zephyr.
• ESP32: ESP-IDF 5.4.2, flash auto-detect, PCNT class, LAN8670 PHY.
• RP2: compressed errors, better lightsleep, hard IRQ timers.
• Zephyr v4.0.0: PWM, SoftI2C/SPI, BLE runtime services, boot.py/main.py support.
• mpremote adds fs tree, improved df, portable config paths.
• Updated lwIP, LittleFS, libhydrogen, stm32lib; expanded hardware/CI tests.

These are all security issues fixed in the vlang-0.5-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ovmf-202602-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libmbedcrypto7-2.28.10-5.1 package on the GA media of openSUSE Tumbleweed.

This update for ovmf fixes the following issue:

• CVE-2025-59438: mbedtls: padding oracle attack possible through timing of cipher error reporting (bsc#1252441).

This update for mbedtls fixes the following issues:

Changes in mbedtls:

• Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes accumulated across the 3.6.2-3.6.6 releases:
  • CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when writing an opaque key pair
  • CVE-2025-27809 (boo#1240051): certificate verification accepted arbitrary hostnames
  • CVE-2025-27810 (boo#1240052): possible authentication bypass on failed memory allocation / hardware errors
  • CVE-2025-47917 (boo#1246783): misleading memory management in mbedtls_x509_string_to_names()
  • CVE-2025-48965 (boo#1246784): NULL pointer dereference after mbedtls_asn1_store_named_data()
  • CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7 padding removal
  • CVE-2025-49600 (boo#1245808): unchecked return values in LMS verification allow signature bypass via fault injection
  • CVE-2025-49601 (boo#1245809): out-of-bounds read in mbedtls_lms_import_public_key()
  • CVE-2025-52496 (boo#1245810): race in AES-NI support detection can lead to AES key extraction or GCM forgery
  • CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing PEM-encrypted material
  • CVE-2025-54764 (boo#1252341): timing attacks in RSA operations
  • CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of cipher error reporting
  • CVE-2026-25833: PSA RNG state duplicated across fork()
  • CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle session-resumption downgrade
  • CVE-2026-25835: RNG state duplicated when application/VM state is cloned

This update for mbedtls-2 fixes the following issues:

Changes in mbedtls-2:

• CVE-2025-52496: race condition in AESNI support detection, AES key disclosure / GCM forgery in multithreaded programs (boo#1245810)
• CVE-2025-59438: padding oracle through timing of cipher error reporting (boo#1252454)

Root has patched CVE-2025-59438 in the mbedtls package for Root:Debian:12. Multiple fixed versions available.

This update for ovmf fixes the following issue:

• CVE-2025-59438: mbedtls: padding oracle attack possible through timing of cipher error reporting (bsc#1252441).

This update for ovmf fixes the following issue:

• CVE-2025-59438: mbedtls: padding oracle attack possible through timing of cipher error reporting (bsc#1252441).

This update for ovmf fixes the following issue:

• CVE-2025-59438: mbedtls: padding oracle attack possible through timing of cipher error reporting (bsc#1252441).

This update for ovmf fixes the following issue:

• CVE-2025-59438: mbedtls: padding oracle attack possible through timing of cipher error reporting (bsc#1252441).