CVE-2025-22866: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec
First published: Thu Feb 06 2025(Updated: )
Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.
Credit: security@golang.org
| Affected Software | Affected Version | How to fix |
|---|
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://go.dev/cl/643735
- https://go.dev/issue/71383
- https://groups.google.com/g/golang-announce/c/xU1ZCHUZw3k
- https://pkg.go.dev/vuln/GO-2025-3447
- https://security.netapp.com/advisory/ntap-20250221-0002/
- https://github.com/golang/go/commit/0cc45e7ca668b103
- https://github.com/golang/go/commit/6644ed63b1e6ccc1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2344219#c4
- https://access.redhat.com/errata/RHSA-2025:3922
- https://bugzilla.redhat.com/show_bug.cgi?id=2344219
- https://www.ibm.com/support/pages/node/7232197 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-22866?
The severity of CVE-2025-22866 is currently assessed to be low, as the bit leakage is not sufficient for recovery of secret scalars.
How do I fix CVE-2025-22866?
To mitigate CVE-2025-22866, it is recommended to update to the latest version of the affected software where the vulnerability has been addressed.
What impact does CVE-2025-22866 have on the ppc64le architecture?
CVE-2025-22866 causes a small number of bits of secret scalars to be leaked, which may affect the security of applications running on the ppc64le architecture.
Is CVE-2025-22866 present in all versions of the software?
CVE-2025-22866 is specific to certain versions of the software that utilize the vulnerable assembly function; it is essential to check your version for exposure.
What steps can be taken to protect against CVE-2025-22866?
Regularly updating software and monitoring for security patches can help protect against CVE-2025-22866 and similar vulnerabilities.
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/severity
- agent/references
- agent/source
- agent/softwarecombine
- agent/description
- agent/event
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-22866
- agent/last-modified-date
- collector/ibm-support
- source/IBM