CVE-2025-54764: 
Mbed TLS vulnerability analysis and mitigation

CVE-2025-54764 affects Mbed TLS versions up to 3.6.4, disclosed on October 15, 2025. The vulnerability involves a local timing attack against certain RSA operations and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gcd functions. This security issue was independently discovered by two teams: the SSBleed team and the M-Step team (Mbed Advisory).

The vulnerability exists in Mbed TLS's modular inversion routine and GCD routine, which are susceptible to local timing attacks. The affected operations include RSA key generation with any API, use of mbedtls_rsa_complete() for importing incomplete RSA private keys, and additional vulnerabilities when MBEDTLS_RSA_NO_CRT is enabled. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.2 MEDIUM (AttackerKB).

When exploited, the vulnerability allows an attacker to fully recover the RSA private key during vulnerable RSA operations. For direct calls to mbedtls_mpi_mod_inv() or mbedtls_mpi_gcd(), the attacker can recover both inputs. The attack can be executed by a local attacker who can run code on the same core as the victim, without requiring elevated privileges (Mbed Advisory).

Two independent teams developed exploitation tools: SSBleed, which uses the Memory Dependence Predictor on Arm-v9 CPUs, and M-Step, which exploits TrustZone-M using timer interrupts to single-step the secure world. Both teams demonstrated successful recovery of RSA private keys. The vulnerability is also likely exploitable through other attack techniques such as SGX-Step, SEV-Step, and similar microarchitectural attacks (Mbed Advisory).

Applications not using RSA private keys or not directly calling mbedtls_mpi_inv_mod() or mbedtls_mpi_gcd() are not affected. For applications that don't generate RSA keys or import private RSA keys with mbedtls_rsa_import()+mbedtls_rsa_complete(), recompiling without MBEDTLS_RSA_NO_CRT provides mitigation. The permanent fix is to upgrade to Mbed TLS 3.6.5 or TF-PSA-Crypto 1.0 (Mbed Advisory).