GHSA-2cgv-28vr-rv6j

Details

On platforms without the core::arch::aarch64::vxarq_u64 intrinsic, an unverified fallback in libcrux-intrinsics v0.0.3 passed incorrect arguments and produced wrong results. This corrupted SHA-3 digests and caused libcrux-ml-kem and libcrux-ml-dsa to sample incorrectly, yielding incorrect shared secrets and invalid signatures.

The issue has been fixed in v0.0.4.

Affected Packages

libcrux-intrinsics

crates.io

Affected versions:

0.0.3

Fixed in:

0.0.4

References

ADVISORYhttps://github.com/advisories/GHSA-2cgv-28vr-rv6j PACKAGEhttps://github.com/cryspen/libcrux WEBhttps://github.com/cryspen/libcrux/commit/8d10f45631afd1d93fabb2278dbb388a075b5608 WEBhttps://github.com/cryspen/libcrux/issues/1220 WEBhttps://github.com/cryspen/libcrux/pull/1222 WEBhttps://rustsec.org/advisories/RUSTSEC-2025-0133.html

GHSA-2cgv-28vr-rv6j

Details

Affected Packages

References

CVSS Analysis

Ecosystems

Timeline