-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is located in the libcrux-intrinsics crate, specifically within a fallback implementation of the _vxarq_u64 function for the aarch64 architecture. This function is intended to emulate a hardware intrinsic when it's not available on the platform. The analysis of the patch in commit 8d10f45631afd1d93fabb2278dbb388a075b5608 reveals that the vulnerable version of the function passed an incorrect argument to an internal bitwise operation. Specifically, _vshlq_n_u64 was called with b instead of a_xor_b, leading to a flawed calculation. This bug corrupts the output of cryptographic primitives that rely on this function, such as SHA-3, causing libcrux-ml-kem to produce incorrect shared secrets and libcrux-ml-dsa to generate invalid signatures. The vulnerability is triggered during runtime on aarch64 systems that execute this specific fallback code path. The fix corrects the argument, ensuring the calculation is performed as intended.
_vxarq_u64libcrux-intrinsics/src/arm64.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libcrux-intrinsics | rust | = 0.0.3 | 0.0.4 |