RUSTSEC-2026-0385: Non-constant-time mask generation and `u128` comparisons

Aperta
  • Qualcosa non va?
#325 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
20/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
security

Direzione di ricerca

The issue describes a security advisory for ctutils and links to RustCrypto/utils pull request 1569, but gives no numtracker files, tests, or requested change. Read the advisory and linked pull request first to determine whether numtracker uses an affected version and where it is declared; done means the project no longer uses a vulnerable version, if the dependency is present.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Non-constant-time mask generation and u128 comparisons

Details
Package ctutils
Version 0.4.2
URL https://github.com/RustCrypto/utils/pull/1569
Date 2026-10-23
Patched versions >=0.4.4

Summary

The ctutils::Choice type has mask generation functions for each unsigned
integer size (u8, u16, u32, u64, u128). These are const fn and
therefore can't reuse the asm!-backed mask generation in the cmov crate
that's otherwise used to ensure constant-time.

In releases prior to v0.4.4, the generated code from these functions could
include a branch on commonly used platforms. This has been corrected in this
release and now verified on several platforms using BINSEC.

Additionally, u128 comparison operations provided via ctutils::Choice and
intended to work in constant-time were generating branches on 32-bit targets.
This has been resolved via a special case implementation of these functions
for such targets.

Impact

Branch instructions on secret values can potentially leak such values via
covert channels. This can enable attackers to potentially recover such secrets.

Resolution

This has been resolved by calling Choice::to_u8() when generating the mask,
which in turn uses black_box as an optimization barrier. Verification that
this resulted in the desired change in the generated assembly across a variety
of target CPU architectures was performed by BINSEC, which now runs
automatically in CI using cargo checkct.

See advisory page for additional details.

Lingua principale
Rust
Stelle
2
Fork
2
Merge medio
13h 13m
PR unite (30g)
5

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di DiamondLightSource/numtracker

Tutte le issue di DiamondLightSource/numtracker

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.