CVE-2025-66442: Mbed TLS Timing Side-Channel Vulnerability

CVE-2025-66442 Overview

CVE-2025-66442 is a timing side channel vulnerability affecting Mbed TLS through version 4.0.0 and TF-PSA-Crypto through version 1.0.0. The vulnerability is triggered by a compiler-induced timing side channel that occurs during RSA and CBC/ECB decryption operations when compiled with LLVM's select-optimize feature. This side channel attack allows local attackers to potentially extract sensitive cryptographic information by analyzing timing variations in decryption operations.

Critical Impact

Local attackers with access to timing information may extract cryptographic keys or sensitive data from RSA and CBC/ECB decryption operations when applications are compiled with vulnerable LLVM optimization settings.

Affected Products

• Mbed TLS through version 4.0.0
• TF-PSA-Crypto through version 1.0.0
• Applications compiled with LLVM's select-optimize feature using these libraries

Discovery Timeline

• April 1, 2026 - CVE-2025-66442 published to NVD
• April 1, 2026 - Last updated in NVD database

Technical Details for CVE-2025-66442

Vulnerability Analysis

This vulnerability represents a timing side channel attack (CWE-385: Covert Timing Channel) that arises from compiler optimization behavior rather than flaws in the cryptographic implementation itself. When Mbed TLS or TF-PSA-Crypto code is compiled using LLVM with the select-optimize feature enabled, the compiler transforms constant-time cryptographic operations into variable-time operations.

Cryptographic libraries like Mbed TLS are designed to execute in constant time to prevent timing attacks, which measure execution time differences to deduce secret information. The select-optimize optimization pass in LLVM can inadvertently convert carefully crafted constant-time code into branching structures that execute in variable time depending on secret data values.

The vulnerability specifically impacts RSA decryption and CBC/ECB block cipher decryption modes, where timing variations can reveal information about private keys or plaintext data. This attack requires local access to measure precise timing information but does not require user interaction or special privileges.

Root Cause

The root cause lies in LLVM's select-optimize compiler pass, which transforms select instructions into conditional branches for performance optimization. While this optimization can improve general code performance, it breaks the constant-time guarantees that cryptographic code relies upon for security. The Mbed TLS library's defensive coding practices to ensure constant-time execution are circumvented at the compiler level, creating exploitable timing variations in RSA operations and CBC/ECB decryption routines.

Attack Vector

The attack requires local access to the target system to measure precise timing information from cryptographic operations. An attacker would need to:

1. Position themselves on the same system or have access to precise timing measurements of the target process
2. Trigger multiple RSA or CBC/ECB decryption operations with chosen or known ciphertexts
3. Measure timing variations across multiple operations to statistically extract information about the secret key or plaintext
4. Apply cryptanalytic techniques to reconstruct sensitive cryptographic material from the observed timing data

This side channel attack does not require authentication or special privileges, but the local access requirement and high attack complexity limit its practical exploitability in many deployment scenarios.

Detection Methods for CVE-2025-66442

Indicators of Compromise

• Unusual patterns of cryptographic operation invocations from untrusted processes
• Processes attempting to measure timing of TLS/cryptographic operations with high precision
• Evidence of high-resolution timing system calls (clock_gettime, rdtsc) correlated with cryptographic library usage
• Memory access patterns consistent with timing side channel exploitation techniques

Detection Strategies

• Monitor for applications using vulnerable Mbed TLS or TF-PSA-Crypto versions compiled with LLVM
• Audit compiler flags used in building cryptographic libraries for the presence of select-optimize optimizations
• Review build configurations to identify LLVM-compiled binaries using affected library versions
• Implement binary analysis to detect non-constant-time patterns in cryptographic code paths

Monitoring Recommendations

• Enable logging for cryptographic operation timing anomalies
• Monitor for unusual process behavior attempting to measure execution timing
• Implement software composition analysis to track Mbed TLS and TF-PSA-Crypto versions across your environment
• Review compiler toolchain configurations in CI/CD pipelines for vulnerable optimization settings

How to Mitigate CVE-2025-66442

Immediate Actions Required

• Upgrade Mbed TLS to a patched version as released by the maintainers
• Upgrade TF-PSA-Crypto to a patched version addressing this vulnerability
• Review and modify compiler flags to disable LLVM's select-optimize feature for cryptographic code
• Recompile affected applications with safe compiler settings or patched library versions

Patch Information

The Mbed TLS project has released security updates addressing this vulnerability. Refer to the MbedTLS Advisory 2026-03 for detailed patch information. Updated releases are available through the GitHub MbedTLS Releases page and GitHub TF-PSA-Crypto Releases page. Review the MbedTLS Security Advisories documentation for complete remediation guidance.

Workarounds

• Disable LLVM's select-optimize pass when compiling Mbed TLS or TF-PSA-Crypto by using appropriate compiler flags
• Use an alternative compiler (GCC) that does not exhibit this behavior for building cryptographic components
• Implement application-level isolation to prevent local timing measurements by untrusted processes
• Consider hardware-based timing attack mitigations where available on target platforms

# Configuration example - Disable select-optimize when compiling with LLVM/Clang
# Add these flags to your build configuration
export CFLAGS="-mllvm -select-optimize=false"

# When using CMake with Mbed TLS
cmake -DCMAKE_C_FLAGS="-mllvm -select-optimize=false" ..

# Verify compiler is not applying select-optimize
clang --version
# Rebuild cryptographic libraries with updated flags