CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms.
Other sources
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 3.0.20-1~deb12u2Fixed in 3.0.22-1~deb12u1 - Upgrade
Upgrade
OpenSSL 3.4to a version that resolves this vulnerability.Fixed in 3.4.8 - Upgrade
Upgrade
OpenSSL 3.5to a version that resolves this vulnerability.Fixed in 3.5.9 - Upgrade
Upgrade
OpenSSL 3.6to a version that resolves this vulnerability.Fixed in 3.6.5 - Upgrade
Upgrade
OpenSSL 4.0to a version that resolves this vulnerability.Fixed in 4.0.3
Event History
Frequently Asked Questions
Which deployments should be prioritized for triage?
Prioritize OpenSSL 4.0, 3.6, 3.5, and 3.4 deployments running on AArch64 or RISC-V that perform SM2 signing or decryption with private keys. OpenSSL 3.0, 1.1.1, and 1.0.2 are not affected.
What level of attacker access is needed?
An attacker must be able to measure the timing of SM2 signing or decryption, or observe the associated cache-line access pattern. These observations can reveal information about the long-term decryption private key or the nonce used for signing.
How can an organization determine whether it is exposed?
Identify systems using an affected OpenSSL release on AArch64 or RISC-V, then determine whether those systems perform SM2 private-key operations such as signing or decryption. Systems not using SM2 operations are not described as exposed by the provided information.
Does this affect the OpenSSL FIPS module?
No. SM2 is not a FIPS algorithm, and the optimized SM2 implementation is not part of the FIPS module.
What upgrade guidance is provided?
OpenSSL 4.0 users should upgrade to OpenSSL 4.0.3. The provided information also identifies OpenSSL 3.6, 3.5, and 3.4 as vulnerable, but does not include their target fixed versions.