Overview
A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leakage is likely insufficient to recover the private key when P-256 is used in any well-known protocols.
Vendor advisories
- RHSA-2025:8670 · Red Hat · fixed in: 8Base-Openshift-Serverless-1.36 · released 2025-06-09 · advisory
- RHSA-2025:3922 · Red Hat · fixed in: RHOSSM 2.5 for RHEL 8 · released 2025-04-15 · advisory
- RHSA-2025:4810 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 · released 2025-05-12 · advisory
- RHSA-2025:4666 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 · released 2025-05-07 · advisory
- RHEA-2025:3039 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 · released 2025-03-19 · advisory
- RHSA-2025:16113 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 · released 2025-09-17 · advisory
- RHSA-2025:4667 · Red Hat · fixed in: Red Hat Ceph Storage 7.1 Tools · released 2025-05-07 · advisory
- RHSA-2025:7466 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2025-05-13 · advisory
- RHSA-2026:67148 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-14 · advisory
- RHSA-2026:4693 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-03-17 · advisory
- RHSA-2026:68504 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-09-17 · advisory
- Red Hat VEX · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 3, Deployment Validation Operator, … · no fix planned: OpenShift Secondary Scheduler Operator, OpenShift Service Mesh 3, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Security 4, … · updated 2026-09-19 · vex
- RHSA-2025:3773 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2025-04-10 · advisory
- RHSA-2025:7326 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2025-05-13 · advisory
crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec — rated Moderate by Red Hat. Released 2025-02-06, updated 2026-09-19.
Affected:
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Confidential Compute Attestation
- Cryostat 3
- Deployment Validation Operator
- Fence Agents Remediation Operator
- Logging Subsystem for Red Hat OpenShift
- Machine Deletion Remediation Operator
- Migration Toolkit for Applications 7
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Multiarch Tuning Operator
- Multicluster Engine for Kubernetes
- NBDE Tang Server
- Network Observability Operator
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Developer Tools and Services
- OpenShift Pipelines
- OpenShift Run Once Duration Override Operator
- OpenShift Secondary Scheduler Operator
- OpenShift Serverless
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- OpenShift Source-to-Image (S2I)
- Power monitoring for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 1.2
- Red Hat Ansible Automation Platform 2
- Red Hat Ceph Storage 5
- Red Hat Ceph Storage 6
- Red Hat Ceph Storage 8
- Red Hat Connectivity Link 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
Fixed:
- 8Base-Openshift-Serverless-1.36
- RHOSSM 2.5 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9
- Red Hat Ceph Storage 7.1 Tools
- Red Hat Enterprise Linux AppStream (v. 10)
- Red Hat Enterprise Linux AppStream (v. 8)
- Red Hat Enterprise Linux AppStream E4S (v.8.8)
- Red Hat Enterprise Linux AppStream TUS (v.8.8)
- Red Hat Enterprise Linux AppStream (v. 9)
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)
- HawtIO HawtIO 4.2.0
- Red Hat OpenShift distributed tracing 3.5.3
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.1
- multicluster engine for Kubernetes 2.6
- multicluster engine for Kubernetes 2.8
- multicluster engine for Kubernetes 2.9
No fix planned:
- OpenShift Secondary Scheduler Operator
- OpenShift Service Mesh 3
- Red Hat 3scale API Management Platform 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ceph Storage 6
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift on AWS
- Cryostat 3
- Fence Agents Remediation Operator
- Logging Subsystem for Red Hat OpenShift
- Machine Deletion Remediation Operator
- Migration Toolkit for Applications 7
- Migration Toolkit for Containers
- Migration Toolkit for Virtualization
- Node HealthCheck Operator
- Node Maintenance Operator
- OpenShift API for Data Protection
- OpenShift Service Mesh 2
- OpenShift Source-to-Image (S2I)
- Power monitoring for Red Hat OpenShift
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Openshift Sandboxed Containers
- Red Hat Quay 3
- Red Hat Service Interconnect 1
- Self Node Remediation Operator
- Assisted Installer for Red Hat OpenShift Container Platform 2
- Builds for Red Hat OpenShift
- cert-manager Operator for Red Hat OpenShift
- Confidential Compute Attestation
- Deployment Validation Operator
- Multiarch Tuning Operator
- Multicluster Engine for Kubernetes
- NBDE Tang Server
Not affected:
- 8Base-Openshift-Serverless-1.36
- RHOSSM 2.5 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
- Red Hat OpenShift distributed tracing 3.5.3
- Custom Metric Autoscaler operator for Red Hat Openshift
- Kube Descheduler Operator
- Logical Volume Manager Storage
- multicluster engine for Kubernetes 2.11
- multicluster engine for Kubernetes 2.1
Remediation
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:8670
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2025:3922
To learn more about Submariner, see https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html/networking/networking#submariner. https://access.redhat.com/errata/RHSA-2025:4810
Package advisory (CVE-2025-22866)
Affected packages:
stdlib >= 1.24.0-0, < 1.24.0-rc.3
Patched in:
Source: https://osv.dev/vulnerability/GO-2025-3447