CVE-2025-22866: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

Deferred

AliasesMGASA-2025-0065SUSE-SU-2025:0392-1SUSE-SU-2025:0393-1+3831 more

Published 06-02-2025Last modified 21-02-2025

Vulnerability summary

CVE-2025-22866 is a medium (CVSS 4.0) vulnerability in go standard library crypto/internal/nistec. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 21.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.0/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.29%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 18 · Related 646

OPENSUSE-SU-2025:14735-1 OPENSUSE-SU-2025:14754-1 OPENSUSE-SU-2025:15030-1 RHSA-2025:3773 RHSA-2025:7326 RHSA-2025:7466+94 more

Showing 100 of 646.

Timeline

06-02-2025
PublishedVulnerability first disclosed.
21-02-2025
Last modifiedVulnerability information updated.

Description

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

CVSS metrics

5 scores · 5 sources · 1 version

v3.14.0

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.29% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard199 products

aactl< 0.4.12-r23
actions-runner-controller< 0.10.1-r3
actions-runner-controller-compat< 0.10.1-r3
actions-runner-controller-fips< 0.10.1-r3
actions-runner-controller-fips-compat< 0.10.1-r3

addon-resizer< 1.8.23-r1
addon-resizer-compat< 1.8.23-r1
addon-resizer-fips< 1.8.23-r1
addon-resizer-fips-compat< 1.8.23-r1
age< 1.2.1-r2
age-fips< 1.2.1-r2
amass< 4.2.0-r19
amazon-cloudwatch-agent< 1.300052.0-r1
amazon-cloudwatch-agent-all< 1.300052.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard< 1.300052.0-r1
amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard-fips< 1.300052.0-r1
amazon-cloudwatch-agent-compat< 1.300052.0-r1
amazon-cloudwatch-agent-config-downloader< 1.300052.0-r1
amazon-cloudwatch-agent-config-downloader-fips< 1.300052.0-r1
amazon-cloudwatch-agent-config-translator< 1.300052.0-r1
amazon-cloudwatch-agent-config-translator-fips< 1.300052.0-r1
amazon-cloudwatch-agent-fips< 1.300052.0-r1
amazon-cloudwatch-agent-operator< 2.1.0-r1
amazon-cloudwatch-agent-operator-compat< 2.1.0-r1
amazon-cloudwatch-agent-operator-fips< 2.1.0-r1
amazon-cloudwatch-agent-operator-fips-compat< 2.1.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent< 1.300052.0-r1
amazon-cloudwatch-agent-start-amazon-cloudwatch-agent-fips< 1.300052.0-r1
amazon-k8s-cni< 1.19.2-r2
amazon-k8s-cni-compat< 1.19.2-r2
amazon-k8s-cni-fips< 1.19.2-r3
amazon-k8s-cni-init< 1.19.2-r2
amazon-k8s-cni-init-compat< 1.19.2-r2
amazon-k8s-cni-init-fips< 1.19.2-r3
amazon-k8s-cni-init-fips-compat< 1.19.2-r3
amazon-ssm-agent< 3.3.1611.0-r3
amazon-ssm-agent-ecs-exec< 3.3.1611.0-r3
ansible-operator< 1.37.1-r2
ansible-operator-compat< 1.37.1-r2
apache-beam-java-11-sdk< 2.62.0-r1
apache-beam-java-17-sdk< 2.62.0-r1
apache-beam-java-21-sdk< 2.62.0-r1
apache-beam-java-sdk< 2.62.0-r1
apache-beam-python-3.11-sdk< 2.62.0-r1
apko< 0.24.0-r1
argo-cd-2.11< 2.11.13-r1
argo-events< 1.9.5-r2
argo-events-fips< 1.9.5-r2
argo-rollouts< 1.8.0-r1
argo-rollouts-fips< 1.8.0-r1
argo-workflows< 3.6.3-r1
argo-workflows-fips< 3.6.3-r0
argocd-image-updater< 0.15.2-r4
argocd-image-updater-compat< 0.15.2-r4
argocd-image-updater-fips< 0.15.2-r3
atlantis< 0.33.0-r1
atlantis-fips< 0.33.0-r1
authservice< 1.0.4-r1
authservice-compat< 1.0.4-r1
authservice-fips< 1.0.4-r1
authservice-fips-compat< 1.0.4-r1
aws-application-networking-k8s< 1.1.0-r3
aws-application-networking-k8s-compat< 1.1.0-r3
aws-ebs-csi-driver< 1.39.0-r1
aws-efs-csi-driver-fips< 2.1.5-r1
aws-flb-cloudwatch< 1.9.4-r15
aws-flb-cloudwatch-compat< 1.9.4-r15
aws-flb-cloudwatch-compat-fips< 1.9.4-r8
aws-flb-cloudwatch-fips< 1.9.4-r8
aws-flb-firehose< 1.7.2-r15
aws-flb-firehose-compat< 1.7.2-r15
aws-flb-firehose-compat-fips< 1.7.2-r8
aws-flb-firehose-fips< 1.7.2-r8
aws-flb-kinesis< 1.10.2-r16
aws-flb-kinesis-compat< 1.10.2-r16
aws-flb-kinesis-compat-fips< 1.10.2-r9
aws-flb-kinesis-fips< 1.10.2-r9
aws-iam-authenticator< 0.6.30-r0
aws-load-balancer-controller< 2.11.0-r3
aws-load-balancer-controller-compat< 2.11.0-r3
aws-load-balancer-controller-fips< 2.11.0-r3
aws-network-policy-agent< 1.1.6-r2
aws-network-policy-agent-compat< 1.1.6-r2
aws-network-policy-agent-compat-fips< 1.1.6-r2
aws-network-policy-agent-fips< 1.1.6-r2
aws-privateca-issuer< 1.4.0-r4
aws-privateca-issuer-compat< 1.4.0-r4
aws-privateca-issuer-compat-fips< 1.4.0-r4
aws-privateca-issuer-fips< 1.4.0-r4
aws-signer-notation-plugin< 1.0.350-r2
aws-signer-notation-plugin-fips< 1.0.350-r2
azcopy< 10.28.0-r1
azcopy-fips< 10.28.0-r1
azure-aad-pod-identity-mic< 1.8.17-r17
azure-aad-pod-identity-nmi< 1.8.17-r17
azuredisk-csi-1.28< 1.28.11-r7
azuredisk-csi-1.28-compat< 1.28.11-r7
azuredisk-csi-1.29< 1.29.12-r2
azuredisk-csi-1.29-compat< 1.29.12-r2
azuredisk-csi-1.30< 1.30.7-r2
azuredisk-csi-1.30-compat< 1.30.7-r2
azuredisk-csi-1.31< 1.31.3-r0
azuredisk-csi-fips-1.28< 1.28.11-r6
azuredisk-csi-fips-1.29< 1.29.12-r2
azuredisk-csi-fips-1.30< 1.30.7-r2
azuredisk-csi-fips-1.31< 1.31.3-r0
bank-vaults< 1.20.4-r24
bank-vaults-fips< 1.20.4-r20
bank-vaults-template< 1.20.4-r24
bank-vaults-template-fips< 1.20.4-r20
bazeliskAll versions (No fix recorded)
bazelisk-defaultAll versions (No fix recorded)
beats-7< 7.17.27-r2
beats-fips-7< 7.17.27-r2
bom< 0.6.0-r16
boring-registry< 0.16.0-r0
boring-registry-fips< 0.16.0-r1
buf< 1.50.0-r2
buildah< 1.39.0-r1
buildctl< 0.19.0-r1
buildctl-fips< 0.19.0-r1
buildkitd< 0.19.0-r1
buildkitd-fips< 0.19.0-r1
caddy< 2.9.1-r4
caddy-fips< 2.9.1-r4
caddy-man< 2.9.1-r4
caddy-src< 2.9.1-r4
cadvisor< 0.51.0-r4
cadvisor-compat< 0.51.0-r4
cadvisor-fips< 0.50.0-r5
calico-3.29< 3.29.2-r0
calico-fips-3.29< 3.29.2-r0
capslock< 0.2.7-r2
cargobump< 0.1.0-r2
cass-operator< 1.23.0-r3
cass-operator-compat< 1.23.0-r3
cass-operator-compat-fips< 1.23.0-r3
cass-operator-config< 1.23.0-r3
cass-operator-fips< 1.23.0-r3
cass-operator-fips-no-pvc-delete< 1.23.0-r3
cass-operator-fips-no-pvc-delete-compat< 1.23.0-r3
cert-exporter< 2.14.0-r6
cert-exporter-fips< 2.14.0-r6
cert-manager-cmctl< 2.1.1-r5
cert-manager-cmctl-fips< 2.1.1-r5
cert-manager-fips-1.17< 1.17.0-r1
cert-manager-istio-csr< 0.14.0-r1
cert-manager-istio-csr-compat< 0.14.0-r1
cert-manager-webhook-pdns< 2.5.1-r11
cert-manager-webhook-pdns-fips< 2.5.1-r13
certificate-transparency< 1.3.1-r2
certificate-transparency-fips< 1.3.1-r2
certificate-transparency-fips-trillian-ctserver< 1.3.1-r2
certificate-transparency-trillian-ctserver< 1.3.1-r2
cfssl< 1.6.5-r15
cfssl-bundle< 1.6.5-r15
cfssl-bundle-fips< 1.6.5-r7
cfssl-certinfo< 1.6.5-r15
cfssl-certinfo-fips< 1.6.5-r7
cfssl-fips< 1.6.5-r7
cfssl-json< 1.6.5-r15
cfssl-json-fips< 1.6.5-r7
cfssl-mkbundle< 1.6.5-r15
cfssl-mkbundle-fips< 1.6.5-r7
cfssl-multirootca< 1.6.5-r15
cfssl-multirootca-fips< 1.6.5-r7
cfssl-newkey< 1.6.5-r15
cfssl-newkey-fips< 1.6.5-r7
cfssl-scan< 1.6.5-r15
cfssl-scan-fips< 1.6.5-r7
chainctl< 0.2.59-r0
chartmuseum< 0.16.2-r11
chartmuseum-fips< 0.16.2-r9
checksec< 3.0.0-r2
chezmoi< 2.59.1-r0
cilium-1.15< 1.15.13-r1 | < 1.15.19-r3
cilium-1.15-clustermesh-apiserver< 1.15.13-r1
cilium-1.15-container-init< 1.15.13-r1
cilium-1.15-container-init-compat< 1.15.13-r1
cilium-1.15-hubble-relay< 1.15.13-r1
cilium-1.15-iptables< 1.15.13-r1
cilium-1.15-operator-aws< 1.15.13-r1
cilium-1.15-operator-generic< 1.15.13-r1
cilium-1.16< 1.16.6-r1
cilium-1.16-clustermesh-apiserver< 1.16.6-r1
cilium-1.16-container-init< 1.16.6-r1
cilium-1.16-container-init-compat< 1.16.6-r1
cilium-1.16-hubble-relay< 1.16.6-r1
cilium-1.16-iptables< 1.16.6-r1
cilium-1.16-operator-aws< 1.16.6-r1
cilium-1.16-operator-generic< 1.16.6-r1
cilium-cli< 0.16.24-r1
cilium-envoy-1.16< 1.16.6-r1
cilium-envoy-fips-1.15< 1.15.13-r1
cilium-envoy-fips-1.16< 1.16.6-r1
cilium-fips-1.15< 1.15.13-r1
cilium-fips-1.16< 1.16.6-r1
cloud-provider-aws-1.28< 1.28.11-r1
cloud-provider-aws-1.28-cloud-controller-manager< 1.28.11-r1

Show all 199

Alpine1 product

go< 1.23.6-r0

2 vendors · 200 products · Showing 200 of 2863

References

24 links

go.dev/cl/643735REPORTFIX
go.dev/issue/71383REPORT
groups.google.com/g/golang-announce/c/xU1ZCHUZw3kREPORTWEB
pkg.go.dev/vuln/GO-2025-3447REPORT
security.netapp.com/advisory/ntap-20250221-0002/
advisories.mageia.org/MGASA-2025-0065.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=34009REPORT
lists.opensuse.org/archives/…WEB
www.suse.com/support/update/announcement/2025/suse-su-20250392-1/Advisory
bugzilla.suse.com/1218424REPORT

Show all 24 references