—

RUSTSEC-2025-0133

Incorrect calculation on aarch64

Details

On platforms without the `core::arch::aarch64::vxarq_u64` intrinsic, an unverified fallback in `libcrux-intrinsics` v0.0.3 passed incorrect arguments and produced wrong results. This corrupted SHA-3 digests and caused `libcrux-ml-kem` and `libcrux-ml-dsa` to sample incorrectly, yielding incorrect shared secrets and invalid signatures.

The issue has been fixed in v0.0.4.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/libcrux-intrinsics

Introduced in: 0.0.4-0Fixed in: 0.0.4

Upgrade libcrux-intrinsics to 0.0.4 or newer (ecosystem crates.io).

References

https://crates.io/crates/libcrux-intrinsics[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2025-0133.html[ADVISORY]
https://github.com/cryspen/libcrux/issues/1220[REPORT]