CVE-2023-25000: Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
Vulnerability summary
CVE-2023-25000 is a medium (CVSS 5.0) Observable Timing Discrepancy vulnerability in hashicorp vault. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 30-03-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
- NVDNIST4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.21% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
- CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
Affected systems
Chainguard5 products
- k3d< 5.6.0-r11
- k3d-proxy< 5.6.0-r11
- k3d-tools< 5.6.0-r11
- vault-1.16All versions (No fix recorded)
- vault-1.16-compatAll versions (No fix recorded)
Wolfi3 products
- k3d< 5.6.0-r11
- k3d-proxy< 5.6.0-r11
- k3d-tools< 5.6.0-r11
Hashicorp2 products
- vault≥ 1.11.0, < 1.11.9 | < 1.11.0 | < 1.11.9 | ≥ 1.12.0, < 1.12.5 | ≥ 1.13.0, < 1.13.1
- vault enterprise≥ 1.13.0, < 1.13.1 | ≥ 1.12.0, < 1.12.5 | ≥ 1.11.0, < 1.11.9 | < 1.11.0
Github.com/hashicorp1 product
- vault< 1.11.9 | ≥ 1.12.0, < 1.12.5 | ≥ 1.13.0, < 1.13.1
4 vendors · 11 products
References
7 links
- github.com/hashicorp/vaultPACKAGE