{"id":"CVE-2025-54764","aliases":["ALPINE-CVE-2025-54764","DEBIAN-CVE-2025-54764","EUVD-2025-35113","GHSA-6237-9hpw-gcm6","JLSEC-2025-232","UBUNTU-CVE-2025-54764","openSUSE-SU-2025:15747-1","openSUSE-SU-2026:21144-1"],"status":"published","title":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct...","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00221,"percentile":0.12848,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-208"],"published":"2025-10-20T00:00:00Z","modified":"2026-11-06T10:05:01Z","fixes":[{"ecosystem":"Alpine:v3.20","package":"mbedtls","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mbedtls","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mbedtls","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mbedtls","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mbedtls","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mbedtls3","fixed_in":["3.6.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mbedtls","fixed_in":["3.6.5-0.1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mbedtls","fixed_in":["3.6.5-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.20","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mbedtls3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.3-1","2.28.4-1","2.28.5-1","2.28.6-1","2.28.7-1","2.28.7-1.1","2.28.7-1.1~exp1","2.28.8-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.2-1","3.6.2-2","3.6.2-3","3.6.3-1","3.6.4-1","3.6.4-2","3.6.5-0.1","3.6.5-0.1~deb13u1","3.6.6-0.1","3.6.6-0.1~deb13u1","3.6.7-2","3.6.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-0.1~deb13u1"}]}],"versions":["3.6.4-2"]},{"source":"osv","ecosystem":"Debian:14","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-0.1"}]}],"versions":["3.6.4-2","3.6.5-0.1~deb13u1"]},{"source":"osv","ecosystem":"Julia","package":"MbedTLS_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-1","2.2.0-1","2.2.1-1","2.2.1-2","2.2.1-2ubuntu0.1","2.2.1-2ubuntu0.2","2.2.1-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1ubuntu1","2.6.0-1","2.7.0-2","2.8.0-1","2.8.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.2-1","2.16.3-1","2.16.4-1ubuntu2","2.16.4-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.9-0.1ubuntu1","2.16.11-0.1ubuntu1","2.16.11-0.3","2.28.0-1","2.28.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.3-1","2.28.6-1ubuntu1","2.28.7-1ubuntu1","2.28.7-1.1ubuntu1","2.28.8-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.5-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-bp160.1.1"}]}],"bundled":15}],"products":[{"vendor":"arm","product":"mbed_tls"}],"references":[{"url":"https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/","tags":["Vendor Advisory","advisory","web","report"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-ssbleed-mstep/","tags":["Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54764","tags":["advisory"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-10-ssbleed-mstep"},{"url":"https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories"},{"url":"https://github.com/advisories/GHSA-6237-9hpw-gcm6"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-54764","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54764.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-54764","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-54764","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54764","tags":["report"]},{"url":"https://github.com/Mbed-TLS/mbedtls/compare/8f4779c6fa40374f88404787bebad85cc7e9969b..eb346801263ba4612b5e29633bd55fe18943ca65","tags":["report"]},{"url":"https://github.com/Mbed-TLS/mbedtls/compare/9b54f934588bc373f3c3f5d45b5a3ad0ae003082..99270322ffac3546f813b1069fd6efb667cdce3f","tags":["report"]},{"url":"https://github.com/Mbed-TLS/mbedtls/compare/246d86b941ef2d2bdeabd7035efe7200bc609b91..a08faf90700e46f6aa2a6e3fee8a6a71ddb816ce","tags":["report"]},{"url":"https://github.com/Mbed-TLS/mbedtls/compare/246d86b941ef2d2bdeabd7035efe7200bc609b91..30f073236922fe4e528fdf82eb442babb50516fa","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-59438","tags":["web"]},{"url":"https://bugzilla.suse.com/1231708","tags":["report"]},{"url":"https://bugzilla.suse.com/1240051","tags":["report"]},{"url":"https://bugzilla.suse.com/1240052","tags":["report"]},{"url":"https://bugzilla.suse.com/1245808","tags":["report"]},{"url":"https://bugzilla.suse.com/1245809","tags":["report"]},{"url":"https://bugzilla.suse.com/1245810","tags":["report"]},{"url":"https://bugzilla.suse.com/1245811","tags":["report"]},{"url":"https://bugzilla.suse.com/1246783","tags":["report"]},{"url":"https://bugzilla.suse.com/1246784","tags":["report"]},{"url":"https://bugzilla.suse.com/1246973","tags":["report"]},{"url":"https://bugzilla.suse.com/1252341","tags":["report"]},{"url":"https://bugzilla.suse.com/1252454","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-49195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-27810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25835","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T00:00:00Z","modified":"2025-10-21T13:55:01.934Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T14:32:27.28543Z"}],"euvd":[{"id":"EUVD-2025-35113","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T00:00:00Z","modified":"2025-10-21T13:55:01Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:29.313974Z"}],"ghsa":[{"id":"GHSA-6237-9hpw-gcm6","title":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct...","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-21T00:30:26Z","modified":"2025-10-21T15:32:03Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-208"],"updated_at":"2026-11-02T15:04:02.994181Z"}],"nvd":[{"id":"CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T22:15:37.06Z","modified":"2026-11-05T22:10:00.203Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-208"],"updated_at":"2026-11-05T23:57:15.690201Z"}],"osv":[{"id":"ALPINE-CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T22:15:37.06Z","modified":"2026-11-03T06:32:51.247962214Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T00:00:00Z","modified":"2026-11-07T02:31:08.758751143Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T03:07:57.488512Z"},{"id":"DEBIAN-CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T22:15:37.06Z","modified":"2026-11-06T10:05:01.239042837Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-06T10:38:22.758306Z"},{"id":"JLSEC-2025-232","title":"Side channel in RSA key generation and operations (SSBleed, M-Step)","description":"## Vulnerability\n\nMbed TLS's modular inversion routine and GCD routine are vulnerable to local\ntiming attacks in a number of settings discussed below.\n\nThese functions are used in RSA, making the following operations vulnerable in\nall configurations:\n\n  - RSA key generation with any API (`mbedtls_rsa_gen_key()` and all\n    `psa_generate_key*()` functions).\n  - Use of `mbedtls_rsa_complete()` to import RSA private keys that are incomplete\n    or not in the standard format. (The only exception is when\n    `MBEDTLS_RSA_NO_CRT` is enabled and all of `N`, `E`, `D`, `P` and `Q` have\n    been set before calling `mbedtls_rsa_complete()`.) (Note: internal uses of\n    `mbedtls_rsa_complete()` in the library are always safe.)\n\nAdditionally, if `MBEDTLS_RSA_NO_CRT` is enabled, the following operations are\nalso vulnerable:\n\n  - Import of RSA key pairs with `psa_import_key()`.\n  - Export of RSA key pairs with any key export API (PSA, PK).\n\nAdditionally, if `MBEDTLS_RSA_NO_CRT` and `MBEDTLS_USE_PSA_CRYPTO` are both\nenabled, the following operations are also vulnerable:\n\n  - Signature generation with PK (`mbedtls_pk_sign()`, `mbedtls_pk_sign_ext()`).\n  - Decryption with PK (`mbedtls_pk_decrypt()`).\n\nElliptic curve cryptography (ECDSA, ECDH, EC-JPAKE) is not affected as the\nvulnerable functions are used in a safe way (with blinding).\n\nFinite-field Diffie-Hellman (FFDH) is not affected as it does not use the\nvulnerable functions.\n\nDirect use of `mbedtls_mpi_inv_mod()` by applications on secret data is most\nlikely vulnerable unless you use proper blinding.\n\nDirect use of `mbedtls_mpi_gcd()` by applications on secret data is most likely\nvulnerable, unless the compiler used has `__builtin_ctz` (GCC 10 and above has\nit, earlier versions don't), and it is not implemented using a loop (most\narchitectures have instructions that are more efficient than using a loop).\n\n## Impact\n\nWhen one of the vulnerable RSA functions mentioned above is used, the\nvulnerability allows the attacker to fully recover the RSA private key.\n\nWhen `mbedtls_mpi_mod_inv()` is directly called by an application (or\n`mbedtls_mpi_gcd()` in a build where it is affected, see above), the\nvulnerability allows the attacker to recover both inputs.\n\n## Attack settings\n\nThe side channels in GCD and modular inversion can be exploited by a local\nattacker in a number of circumstances. Two teams independently developed tools\nallowing to trace a victim process, recover the inputs to\n`mbedtls_mpi_mod_inv()` and break RSA key generation:\n\n 1. SSBleed: this uses the Memory Dependence Predictor (MDP) on some\n    Arm-v9 CPUs. The attacker only needs to be able to run code on the same core\n    as the victim but does not need elevated privileges. The proof of concept\n    fully recovers RSA private keys from `mbedtls_rsa_gen_key()` and the same\n    principle applies to other unblinded uses of `mbedtls_mpi_inv_mod()`.\n 2. M-Step: in a setting where TrustZone-M is used, the M-Step framework allows\n    the non-secure world to abuse timer interrupts to effectively single-step the\n    secure world and trace its execution flow.\n    The proofs of concepts fully recover RSA private keys from\n    `mbedtls_rsa_gen_key()` and `mbedtls_rsa_complete()`. Several other\n    exploitation paths in RSA are identified. In particular, `mbedtls_mpi_gcd()`\n    is found to be vulnerable when Mbed TLS is compiled with a compiler that does\n    not have `__builtin_ctz`.\n\nThe same functions are most probably also vulnerable in other circumstances\nusing similar attack techniques: SGX-Step, SEV-Step, microarchitectural\nattacks similar to SSBleed...\n\n### Credits\n\n**SSBleed:** Chang Liu from Tsinghua University and Trevor E. Carlson from National University of Singapore\n\n**M-Step:** Cristiano Rodrigues (University of Minho), Marton Bognar (DistriNet, KU Leuven), Sandro Pinto (University of Minho), Jo Van Bulck (DistriNet, KU Leuven)\n\n## Affected versions\n\nAll versions of Mbed TLS up to 3.6.4 are affected.\n\n## Work-around\n\nApplications that do not generate RSA keys and do not import private RSA keys\nwith `mbedtls_rsa_import()`+`mbedtls_rsa_complete()`, but use other RSA\nfunctions that are only vulnerable with `MBEDTLS_RSA_NO_CRT`, can recompile\nwithout `MBEDTLS_RSA_NO_CRT`.\n\nApplications that do not use RSA private keys and do not directly call\n`mbedtls_mpi_inv_mod()` or `mbedtls_mpi_gcd()` are not affected.\n\n## Resolution\n\nAffected users should upgrade to Mbed TLS 3.6.5 or TF-PSA-Crypto 1.0.","status":"published","published":"2025-11-21T15:59:04.054Z","modified":"2026-07-18T00:01:06.071917538Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2025-54764","description":"Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd.","status":"published","published":"2025-10-20T22:15:00Z","modified":"2026-04-22T16:06:03.041184Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"openSUSE-SU-2025:15747-1","title":"libeverest-3.6.5-1.1 on GA media","description":"These are all security issues fixed in the libeverest-3.6.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-19T00:00:00Z","modified":"2026-03-23T04:54:09.919148Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:21144-1","title":"Security update for mbedtls","description":"This update for mbedtls fixes the following issues:\n\nChanges in mbedtls:\n\n- Update to 3.6.6 (LTS maintenance update from 3.6.1); security fixes\n  accumulated across the 3.6.2-3.6.6 releases:\n  * CVE-2024-49195 (boo#1231708): buffer underrun in pkwrite when\n    writing an opaque key pair\n  * CVE-2025-27809 (boo#1240051): certificate verification accepted\n    arbitrary hostnames\n  * CVE-2025-27810 (boo#1240052): possible authentication bypass on\n    failed memory allocation / hardware errors\n  * CVE-2025-47917 (boo#1246783): misleading memory management in\n    mbedtls_x509_string_to_names()\n  * CVE-2025-48965 (boo#1246784): NULL pointer dereference after\n    mbedtls_asn1_store_named_data()\n  * CVE-2025-49087 (boo#1246973): timing side channel in PKCS#7\n    padding removal\n  * CVE-2025-49600 (boo#1245808): unchecked return values in LMS\n    verification allow signature bypass via fault injection\n  * CVE-2025-49601 (boo#1245809): out-of-bounds read in\n    mbedtls_lms_import_public_key()\n  * CVE-2025-52496 (boo#1245810): race in AES-NI support detection can\n    lead to AES key extraction or GCM forgery\n  * CVE-2025-52497 (boo#1245811): one-byte heap underflow when parsing\n    PEM-encrypted material\n  * CVE-2025-54764 (boo#1252341): timing attacks in RSA operations\n  * CVE-2025-59438 (boo#1252454): padding-oracle attack via timing of\n    cipher error reporting\n  * CVE-2026-25833: PSA RNG state duplicated across fork()\n  * CVE-2026-25834: TLS 1.3 HelloRetryRequest man-in-the-middle\n    session-resumption downgrade\n  * CVE-2026-25835: RNG state duplicated when application/VM state is\n    cloned\n","status":"published","published":"2026-06-22T13:34:13Z","modified":"2026-06-30T18:24:45.186057867Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}