CVE-2025-27587

OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openssl/openssl/issues/24253
https://minerva.crocs.fi.muni.cz

Configurations

No configuration.

History

26 Jun 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-16 22:15

Updated : 2025-06-26 17:15

NVD link : CVE-2025-27587

Mitre link : CVE-2025-27587

CVE.ORG link : CVE-2025-27587

JSON object : View

Products Affected

No product.

CWE

CWE-385

Covert Timing Channel

{"id": "CVE-2025-27587", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2025-06-16T22:15:44.093", "references": [{"url": "https://github.com/openssl/openssl/issues/24253", "source": "cve@mitre.org"}, {"url": "https://minerva.crocs.fi.muni.cz", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-385"}]}], "descriptions": [{"lang": "en", "value": "OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system."}, {"lang": "es", "value": "OpenSSL 3.0.0 a 3.3.2 en la arquitectura PowerPC es vulnerable a un ataque Minerva. Este ataque se puede explotar midiendo el tiempo de firma de mensajes aleatorios mediante la API EVP_DigestSign y, posteriormente, utilizando la clave privada para extraer el valor K (nonce) de las firmas. A continuaci\u00f3n, bas\u00e1ndose en el tama\u00f1o en bits del nonce extra\u00eddo, se puede comparar el tiempo de firma de nonces de tama\u00f1o completo con el de firmas que utilizan nonces m\u00e1s peque\u00f1os mediante pruebas estad\u00edsticas. Existe un canal lateral en la curva P-364 que permite la extracci\u00f3n de la clave privada (adem\u00e1s, existe una dependencia entre el tama\u00f1o en bits de K y el tama\u00f1o del canal lateral). NOTA: Esta CVE es controvertida porque la pol\u00edtica de seguridad de OpenSSL indica expl\u00edcitamente que cualquier canal lateral que requiera la detecci\u00f3n del mismo sistema f\u00edsico queda fuera del modelo de amenazas del software. La se\u00f1al de tiempo es tan peque\u00f1a que es imposible detectarla sin que el proceso atacante se ejecute en el mismo sistema f\u00edsico."}], "lastModified": "2025-06-26T17:15:30.497", "sourceIdentifier": "cve@mitre.org"}