This vulnerability arises from a compiler optimization feature in LLVM (select-optimize) that induces timing side channels in cryptographic operations within Mbed TLS (up to version 4.0.0) and TF-PSA-Crypto (up to version 1.0.0). The side channel affects RSA and CBC/ECB decryption, potentially leaking sensitive information through timing variations. The issue is compiler-induced rather than a direct flaw in the cryptographic implementation. No patch or remediation details are provided in the advisory, and no active exploitation has been reported.

The impact is a potential timing side channel that could allow an attacker to infer sensitive cryptographic information during RSA and CBC/ECB decryption operations when LLVM's select-optimize feature is used. This could weaken the confidentiality guarantees of the affected cryptographic libraries. However, no known exploits in the wild have been reported, and the vulnerability depends on specific compiler optimization settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling LLVM's select-optimize feature during compilation or avoid using affected versions of Mbed TLS and TF-PSA-Crypto with this compiler optimization enabled. Monitor official Microsoft Security Response Center advisories for updates.