CVE-2025-54764: Arm Mbed TLS Timing Attack Vulnerability

CVE-2025-54764 Overview

CVE-2025-54764 is a local timing side-channel vulnerability affecting Mbed TLS versions prior to 3.6.5. The flaw permits a local attacker to observe timing variations during certain RSA operations and direct calls to the mbedtls_mpi_mod_inv or mbedtls_mpi_gcd functions. Successful exploitation can reveal confidential information such as RSA private key material. The issue is tracked as part of the Mbed TLS Security Advisory 2025-10 (SSBleed/MSTEP) and categorized under [CWE-208: Observable Timing Discrepancy].

Critical Impact
A local attacker with the ability to measure execution timing of Mbed TLS cryptographic primitives can recover sensitive key material from RSA operations.

Affected Products

Arm Mbed TLS versions before 3.6.5
Applications linking against vulnerable Mbed TLS releases that perform RSA operations
Software invoking mbedtls_mpi_mod_inv or mbedtls_mpi_gcd on secret inputs

Discovery Timeline

2025-10-20 - CVE-2025-54764 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54764

Vulnerability Analysis

Mbed TLS implements RSA using modular arithmetic primitives from its multiple-precision integer (MPI) library. The functions mbedtls_mpi_mod_inv (modular inverse) and mbedtls_mpi_gcd (greatest common divisor) execute in time dependent on their operands. When these primitives are invoked with secret values during RSA private key operations, the execution time correlates with bit patterns of the secret.

A local attacker who can measure the duration of RSA operations, through shared-core cache timing, performance counters, or process scheduling observations, can statistically recover information about the private key. The vulnerability requires local access but no privileges or user interaction, and compromises confidentiality without affecting integrity or availability.

Root Cause

The root cause is the absence of constant-time implementations in mbedtls_mpi_mod_inv and mbedtls_mpi_gcd. These functions follow data-dependent control flow and perform a variable number of iterations based on input values. When secret-dependent inputs flow into these routines, timing becomes a side channel that leaks bits of the secret.

Attack Vector

Exploitation requires local co-residency with the victim process. The attacker runs code on the same host, measures the time Mbed TLS takes to perform RSA signatures or decryptions, and applies statistical analysis to reconstruct the private key. The attack scenario matches typical microarchitectural side-channel conditions. Refer to the Mbed TLS Security Advisory 2025-10 for the full technical analysis.

Detection Methods for CVE-2025-54764

Indicators of Compromise

No network-based indicators exist because the attack is local and passive from the kernel's perspective.
Presence of unauthorized local processes performing high-resolution timing measurements against processes using Mbed TLS.
Unexpected CPU co-location of untrusted workloads with services performing RSA private key operations.

Detection Strategies

Inventory all binaries and containers linking Mbed TLS and verify library versions against the 3.6.5 baseline.
Audit application code paths that call mbedtls_mpi_mod_inv or mbedtls_mpi_gcd with secret inputs.
Monitor for processes repeatedly invoking performance counter interfaces or rdtsc instructions near cryptographic workloads.

Monitoring Recommendations

Alert on unexpected local accounts or workloads scheduled on hosts that perform TLS termination or signing operations.
Track package manager events for installations and upgrades of Mbed TLS and dependent libraries.
Correlate anomalous CPU scheduling and sibling-thread activity on servers running Mbed TLS-based services.

How to Mitigate CVE-2025-54764

Immediate Actions Required

Upgrade Mbed TLS to version 3.6.5 or later across all systems and container images.
Rebuild and redeploy applications that statically link Mbed TLS to pick up the patched library.
Rotate RSA keys that may have been used on vulnerable hosts shared with untrusted workloads.

Patch Information

Arm published the fix in Mbed TLS 3.6.5. Details are provided in the Mbed TLS Security Advisory 2025-10 and the aggregated Mbed TLS Security Advisories page. Downstream distributions and embedded vendors should ship backports to supported branches.

Workarounds

Isolate workloads that perform RSA private key operations onto dedicated hosts without untrusted tenants.
Avoid passing secret values to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd until the library is upgraded.
Restrict local access and limit the use of high-resolution timers for untrusted users where feasible.

bash

# Verify installed Mbed TLS version meets the 3.6.5 fix baseline
pkg-config --modversion mbedtls
# For source builds, pin the dependency to a fixed release
git -C mbedtls checkout v3.6.5 && make clean && make