wolfSSL Timing Side-Channel Vulnerability in Constant-Time Implementations

A vulnerability exists in wolfSSL versions prior to 5.8.4, where multiple constant-time implementations may be altered into non-constant-time binaries by LLVM optimizations. This alteration can create observable timing differences, potentially leading to information disclosure through timing side-channel attacks.

Impact

Exploitation of this vulnerability could allow for information disclosure via timing side-channel attacks, taking advantage of the introduced timing discrepancies.

Remediation

Users can update to wolfSSL version 5.8.4 or later to address this vulnerability.