CVE-2025-7396: Curve25519 Blinding
In wolfSSL release 5.8.2 blinding support is turned on by default for Curve25519 in applicable builds. The blinding configure option is only for the base C implementation of Curve25519. It is not needed, or available with; ARM assembly builds, Intel assembly builds, and the small Curve25519 feature. While the side-channel attack on extracting a private key would be very difficult to execute in practice, enabling blinding provides an additional layer of protection for devices that may be more susceptible to physical access or side-channel observation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If you need to disable or control Curve25519 blinding in wolfSSL 5.8.2, use the blinding configure option only affects the base C implementation of Curve25519 (not available for ARM assembly builds, Intel assembly builds, or the small Curve25519 feature).
wolfSSL Curve25519 (base C implementation) blinding = turned on by default in release 5.8.2 (applicable builds)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7396?
The CVE-2025-7396 vulnerability has a medium severity rating due to the potential for side-channel attacks on Curve25519 implementations.
How do I fix CVE-2025-7396?
To fix CVE-2025-7396, you should update to the latest version of wolfSSL that disables blinding for non-C implementations.
What versions of wolfSSL are affected by CVE-2025-7396?
CVE-2025-7396 affects wolfSSL versions prior to the fix implemented in release 5.8.2.
What specific functionality does CVE-2025-7396 impact?
CVE-2025-7396 impacts the default blinding support for Curve25519 in specific builds of wolfSSL.
Is blinding necessary in all builds of wolfSSL affected by CVE-2025-7396?
No, blinding is not needed or available in ARM assembly builds, Intel assembly builds, and small Curve implementations.