CVE-2026-3580: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-3580 is a side-channel vulnerability in wolfSSL 5.8.4 affecting ECC scalar multiplication on RISC-V RV32I targets. When compiled with GCC at optimization level -O3, constant-time masking logic in the sp_256_get_entry_256_9 function is transformed into conditional branches (bnez), breaking side-channel resistance and potentially allowing a local attacker to recover secret cryptographic keys via timing analysis. The vulnerability was published on March 19, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium) and a CVSS v4.0 base score of 2.1 (Low) (Feedly, ENISA EUVD).

The root cause is classified as CWE-203 (Observable Discrepancy), specifically a compiler-induced timing side channel. The GCC compiler, when targeting RISC-V RV32I (without the M multiplication extension) with -O3 optimization, replaces constant-time masking operations in sp_256_get_entry_256_9 with conditional branch instructions (bnez). This optimization eliminates the constant-time property of ECC scalar multiplication, making execution time dependent on secret key bits. The fix, merged in pull request #9855, implements a constant-time __muldi3 replacement (defined when SP_NO_MUL_INSTRUCTION is set) and corrects the get_entry function to perform constant-time comparisons, ensuring the optimization does not introduce observable timing differences (GitHub PR #9855).

Successful exploitation allows a local attacker with low privileges to perform timing analysis of ECC scalar multiplication operations and potentially recover private cryptographic keys used in TLS or other protocols relying on wolfSSL's ECC implementation. The impact is limited to confidentiality (no integrity or availability impact), and is constrained to systems where wolfSSL is compiled for RISC-V RV32I without the M extension using GCC -O3. Exposure is further limited to local access scenarios, reducing the risk of broad network-based exploitation (Feedly, ENISA EUVD).

1. Identify target: Locate a system running wolfSSL 5.8.4 compiled for RISC-V RV32I without the M extension using GCC with -O3 optimization, where ECC operations (e.g., TLS handshakes) are performed.
2. Gain local access: Obtain local unprivileged access to the target system (e.g., via a shell account or co-located process).
3. Collect timing measurements: Repeatedly trigger ECC scalar multiplication operations (e.g., by initiating TLS connections or cryptographic operations) and measure execution time using high-resolution timers available locally.
4. Analyze timing data: Apply statistical timing analysis techniques (e.g., cache-timing or branch-timing attacks) to correlate observed timing variations with conditional branch behavior in sp_256_get_entry_256_9.
5. Recover secret key bits: Use the timing information to infer individual bits of the ECC private scalar, iteratively reconstructing the full private key (GitHub PR #9855, Feedly).

The fix was merged into wolfSSL master on March 5, 2026 (commit 8a5c1c7), and is targeted for release in wolfSSL 5.9.2. Users should upgrade to wolfSSL 5.9.2 or later when available. As a workaround, avoid compiling wolfSSL for RISC-V RV32I targets with GCC -O3 optimization until the patched version is deployed; using -O2 or enabling the RISC-V M extension may avoid the problematic compiler transformation. The openembedded/meta-openembedded project has also backported the fix as a patch for affected embedded Linux builds (GitHub PR #9855, ENISA EUVD).

The fix was developed by wolfSSL contributor SparkiDev and reviewed and merged by wolfSSL maintainer douzzer, with testing confirming correct behavior at both -O0 and -O3 optimization levels. The patch was subsequently backported to the openembedded/meta-openembedded project for embedded Linux distributions. No significant broader media coverage or notable public researcher commentary beyond the GitHub pull request discussion has been identified (GitHub PR #9855).