OpenSSL x86_64 Montgomery Squaring Private-Key Disclosure

A remote attacker may obtain information that contributes to recovery of a target private key, resulting in high confidentiality impact. Exploitation against RSA and DSA was assessed as exceptionally difficult and unlikely. Diffie-Hellman is the comparatively feasible target, but exploitation remains highly resource-intensive; much of the key-deduction work can be performed offline. The issue does not inherently provide integrity impact, code execution, or denial of service.

No complete workaround is identified. Until updates can be deployed, reduce exposure of services using vulnerable OpenSSL builds, particularly externally reachable services offering finite-field DHE. Avoid persistent Diffie-Hellman parameters and reuse of a Diffie-Hellman private key across clients, and prefer unaffected elliptic-curve key-exchange configurations where operationally suitable.

Upgrade OpenSSL 1.0.2 deployments to 1.0.2k or later, and OpenSSL 1.1.0 deployments to 1.1.0d or later. Apply the vendor-supported security update for products that bundle OpenSSL, then restart affected processes or systems so that they load the corrected cryptographic library.