The vulnerability arises because EVP_PKEY_derive_set_peer() performs the subgroup membership check using the peer's q parameter instead of the local key's q, and does not compare the q values between peer and local keys. A malicious peer can present an X9.42 key with the victim's p and g parameters but a forged small prime q, and a public value Y of order r (a small prime factor). This causes the shared secret to leak partial private key information mod r. By repeating this for each small prime factor of the cofactor and combining results via the Chinese Remainder Theorem, the full private key can be recovered. The affected FIPS modules include versions 4.0, 3.6, 3.5, 3.4, and 3.0. The attack surface is limited to specific use cases involving static DHX keys in interactive protocols.

An attacker who can act as a malicious peer in a key exchange using DHX (X9.42) keys can recover the victim's private key after a small number of attempts by exploiting improper subgroup membership checks. This compromises the confidentiality of the victim's private key in affected deployments. The impact is limited by the narrow attack surface, mainly affecting certain CMP deployments and bespoke applications using static DHX keys.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using DHX (X9.42) static keys in interactive protocols or long-lived RA/CA DHX keys in CMP deployments. Monitor vendor communications for updates and apply official patches once released.