CVE-2026-77696: 
OpenSSL vulnerability analysis and mitigation

CVE-2026-77696 is a timing side-channel vulnerability in OpenSSL's SM2 signature generation that can allow an attacker to recover the private key. The sm2_sig_gen() function uses variable-time BIGNUM operations (BN_mod_mul() and BN_sub()) on the secret nonce and private key, causing execution time to depend on secret values. Affected versions span OpenSSL 1.1.1 before 1.1.1zj, 3.0.x before 3.0.23, 3.4.x before 3.4.8, 3.5.x before 3.5.9, 3.6.x before 3.6.5, and 4.0.x before 4.0.3. It was disclosed on September 29, 2026, with a CVSS v3.1 base score of 3.7 (Low) (OpenSSL Advisory, Red Hat).

The root cause is CWE-208 (Observable Timing Discrepancy): the sm2_sig_gen() function in crypto/sm2/sm2_sign.c computed the SM2 signature value s = ((1 + dA)^-1 * (k - r * dA)) mod order using generic BN_mod_mul() and BN_sub() operations, which internally use BN_div() whose timing is value-dependent. Additionally, the per-signature secret nonce k was not pinned to a fixed-width representation, allowing its magnitude to leak through operand lengths in the scalar copy inside the elliptic curve ladder. An attacker positioned to measure SM2 signing times over many signatures can accumulate timing measurements and apply a lattice/Hidden Number Problem (HNP) attack to recover the per-signature nonce, and ultimately the private key. The fix replaces variable-time operations with fixed-top Montgomery constant-time primitives (bn_to_mont_fixed_top, bn_mul_mont_fixed_top, bn_mod_sub_fixed_top) and pins the nonce with BN_FLG_CONSTTIME and bn_set_top_fixed() (OpenSSL Commit, Red Hat Bugzilla).

Successful exploitation leads to confidentiality impact through private key recovery — an attacker who can observe SM2 signing times across many operations can reconstruct the private key used for SM2 signatures. This affects all platforms where applications perform SM2 signature generation. There is no integrity or availability impact, and SM2 is not a FIPS algorithm so FIPS-mode deployments are unaffected. Private key compromise could enable impersonation, decryption of protected communications, or forging of digital signatures depending on how the key is used (OpenSSL Advisory, Red Hat).

No public proof-of-concept exploit or in-the-wild exploitation has been reported as of the disclosure date (Red Hat). The NVD SSVC assessment classifies the vulnerability as not automatable with partial technical impact. The EPSS score is approximately 0.243%, indicating a low near-term exploitation probability. The attack requires high complexity — the attacker must be able to make or observe a large number of SM2 signing operations and perform sophisticated lattice/HNP cryptanalysis offline. The vulnerability is not listed in the CISA KEV catalog.

1. Identify target: Locate a service or application that performs SM2 signature generation using a vulnerable OpenSSL version (1.1.1 < 1.1.1zj, 3.0.x < 3.0.23, 3.4.x < 3.4.8, 3.5.x < 3.5.9, 3.6.x < 3.6.5, or 4.0.x < 4.0.3) and is accessible over a network.
2. Trigger repeated signing operations: Send a large number of requests that cause the target to perform SM2 signature generation (e.g., TLS handshakes using SM2, API calls that produce SM2-signed responses), collecting precise timing measurements for each operation.
3. Collect timing data: Record high-resolution timing for each signing operation. The variable-time BN_mod_mul() and BN_sub() operations cause measurable differences correlated with the secret nonce k and private key dA.
4. Apply lattice/HNP attack: Use the collected timing data to extract partial information (bias) about the per-signature nonce k for each signature. Feed the biased nonce data into a Hidden Number Problem (HNP) solver using lattice reduction techniques (e.g., LLL or BKZ algorithms).
5. Recover private key: Solve the HNP to recover the private key dA from the accumulated nonce bias across many signatures (OpenSSL Advisory, OpenSSL Commit).

Update OpenSSL to a patched version: 1.1.1zj or later, 3.0.23 or later, 3.4.8 or later, 3.5.9 or later, 3.6.5 or later, or 4.0.3 or later. Patches are available via the OpenSSL project and downstream distributions including Red Hat (RHSA-2026:74162), Ubuntu (USN-8847-1, USN-8847-2), SUSE (SUSE-SU-2026:4413-1, SUSE-SU-2026:4419-1), and others. If SM2 signature operations are not required by your application, consider disabling SM2 support in your OpenSSL configuration as a workaround (OpenSSL Advisory, Red Hat).

The OpenSSL project disclosed the vulnerability in its September 29, 2026 security advisory alongside multiple other fixes in the 4.0.3 release. Red Hat, Ubuntu, SUSE, and other major Linux distributions promptly issued advisories and updated packages. The fix was noted to follow a prior related fix for CVE-2025-9231, with the commit message explicitly stating that sm2_sig_gen() still used variable-time operations after that earlier fix (OpenSSL Advisory, OpenSSL Commit).