Search: CVE-2025-9231

CVE-2025-9231 is a timing side-channel vulnerability in the SM2 algorithm implementation on 64-bit ARM platforms in OpenSSL versions 3.2.0, 3.3.0, 3.4.0, and 3.5.0. This flaw could potentially allow an attacker to recover the private key by analyzing timing variations during signature computations. The vulnerability is considered moderate severity and does not affect OpenSSL's FIPS modules or typical TLS usage since SM2 certificates are not directly supported in TLS by default. Exploitation over a network has not been demonstrated but remains a theoretical risk if custom providers add SM2 support.