# CVE-2025-9231: Timing side-channel in SM2 algorithm on 64 bit ARM

Status: published. Published: 2025-09-30. Updated: 2026-11-06.

Issue summary: A timing side-channel which could potentially allow remote
recovery of the private key exists in the SM2 algorithm implementation on 64 bit
ARM platforms.

Impact summary: A timing side-channel in SM2 signature computations on 64 bit
ARM platforms could allow recovering the private key by an attacker..

While remote key recovery over a network was not attempted by the reporter,
timing measurements revealed a timing signal which may allow such an attack.

OpenSSL does not directly support certificates with SM2 keys in TLS, and so
this CVE is not relevant in most TLS contexts.  However, given that it is
possible to add support for such certificates via a custom provider, coupled
with the fact that in such a custom provider context the private key may be
recoverable via remote timing measurements, we consider this to be a Moderate
severity issue.

The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this
issue, as SM2 is not an approved algorithm.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/fc47a2ec078912b3e914fab5734535e76c4820c2
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/eed5adc9f969d77c94f213767acbb41ff923b6f4
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/567f64386e43683888212226824b6a179885a0fe
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/cba616c26ac8e7b37de5e77762e505ba5ca51698

## Affected products and versions

- OpenSSL / OpenSSL: ≥ 3.5.0; < 3.5.4 (affected, semver); ≥ 3.4.0; < 3.4.3 (affected, semver); ≥ 3.3.0; < 3.3.5 (affected, semver); ≥ 3.2.0; < 3.2.6 (affected, semver). Source: CNA: openssl
- Siemens / RUGGEDCOM RST2428P: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / RUGGEDCOM RST2428P: ≥ 0; < V4.0 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XCH328: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XCM324: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XCM328: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XCM332: ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRH334 (24 V DC, 8xFO, CC): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (230 V AC, 12xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (230 V AC, 8xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (24 V DC, 12xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (24 V DC, 8xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (2x230 V AC, 12xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (2x230 V AC, 8xFO): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+): ≥ 0; < V3.3 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIDIS Secured SmartPlug: ≥ 0; < V7.26.0310 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC CN 4100: ≥ 0; < V5.0 (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N; source: ADP: CISA-ADP

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N; source: NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- CISA KEV: No listing in collected sources

- EPSS: 2.24% as of 2026-11-06; percentile 82.93%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-385

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://openssl-library.org/news/secadv/20250930.txt (CNA: openssl; vendor-advisory)

- https://github.com/openssl/openssl/commit/fc47a2ec078912b3e914fab5734535e76c4820c2 (CNA: openssl; patch)

- https://github.com/openssl/openssl/commit/eed5adc9f969d77c94f213767acbb41ff923b6f4 (CNA: openssl; patch)

- https://github.com/openssl/openssl/commit/567f64386e43683888212226824b6a179885a0fe (CNA: openssl; patch)

- https://github.com/openssl/openssl/commit/cba616c26ac8e7b37de5e77762e505ba5ca51698 (CNA: openssl; patch)

- http://www.openwall.com/lists/oss-security/2025/09/30/5 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2026/05/11/11 (ADP: CVE)

- https://cert-portal.siemens.com/productcert/html/ssa-089022.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-032379.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-253495.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-585531.html (ADP: siemens-SADP)

- https://github.com/openssl/openssl/commit/567f64386e43683888212226824b6a179885a0fe (openssl-security@openssl.org)

- https://github.com/openssl/openssl/commit/cba616c26ac8e7b37de5e77762e505ba5ca51698 (openssl-security@openssl.org)

- https://github.com/openssl/openssl/commit/eed5adc9f969d77c94f213767acbb41ff923b6f4 (openssl-security@openssl.org)

- https://github.com/openssl/openssl/commit/fc47a2ec078912b3e914fab5734535e76c4820c2 (openssl-security@openssl.org)

- https://openssl-library.org/news/secadv/20250930.txt (openssl-security@openssl.org)

- http://www.openwall.com/lists/oss-security/2025/09/30/5 (af854a3a-2127-422b-91ae-364da2661108)

- http://www.openwall.com/lists/oss-security/2026/05/11/11 (af854a3a-2127-422b-91ae-364da2661108)

- https://cert-portal.siemens.com/productcert/html/ssa-032379.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

- https://cert-portal.siemens.com/productcert/html/ssa-089022.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

- https://cert-portal.siemens.com/productcert/html/ssa-253495.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

- https://cert-portal.siemens.com/productcert/html/ssa-585531.html (0b142b55-0307-4c5a-b3c9-f314f3fb7c5e)

## Provenance

- CNA: openssl: https://www.cve.org/CVERecord?id=CVE-2025-9231; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-9231; retrieved 2026-11-07; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2025-9231; retrieved 2026-11-06; source updated Not reported

Revision: 0b484f077dc6736411b3e61ac8786cf2a2f4925f3cdfe855715fb590b3aaf632

Canonical: https://y2.dev/cve/CVE-2025-9231

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.