rustsec-2026-0387

debian_rustsec
Description

## Summary Several operations intended to be constant-time could execute secret-dependent branches, depending on the compiler and target CPU. These include subtraction, zero counting, division, and Montgomery multiplication. Additionally, `UintRef` equality could terminate at the first unequal limb, and `BoxedMontyForm::invert` branched on whether an inverse exists. ## Impact Applications using affected operations on secret integers may leak information through timing or microarchitectural side channels. This includes information about intermediate arithmetic values, matching limbs, and invertibility. Such leakage could potentially enable recovery of cryptographic secrets. Practical exploitability depends on the downstream algorithm, compiler, target CPU, and an attacker's ability to observe the side channel. ## Resolution Upgrade to v0.7.6, which removes the identified branches, updates `ctutils` to include its constant-time fixes, and adds BINSEC-based regression checks using `cargo checkct` for arithmetic on multiple targets.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "aliases": [],
  "categories": [
    "crypto-failure"
  ],
  "crate": "crypto-bigint",
  "cves": [],
  "cvss": 0.0,
  "database_specific": {
    "severity": ""
  },
  "date": "2026-10-23",
  "deb_packages": [
    {
      "crate_name": "hussh",
      "deb_name": "hussh",
      "version": "0.2.3-1"
    },
    {
      "crate_name": "crypto-bigint",
      "deb_name": "librust-crypto-bigint-0.5-dev",
      "version": "0.5.5-1"
    },
    {
      "crate_name": "crypto-bigint",
      "deb_name": "librust-crypto-bigint-dev",
      "version": "0.7.5-2"
    }
  ],
  "description": "## Summary\n\nSeveral operations intended to be constant-time could execute secret-dependent\nbranches, depending on the compiler and target CPU. These include subtraction,\nzero counting, division, and Montgomery multiplication.\n\nAdditionally, `UintRef` equality could terminate at the first unequal limb,\nand `BoxedMontyForm::invert` branched on whether an inverse exists.\n\n## Impact\n\nApplications using affected operations on secret integers may leak information\nthrough timing or microarchitectural side channels. This includes information\nabout intermediate arithmetic values, matching limbs, and invertibility.\n\nSuch leakage could potentially enable recovery of cryptographic secrets.\nPractical exploitability depends on the downstream algorithm, compiler, target\nCPU, and an attacker's ability to observe the side channel.\n\n## Resolution\n\nUpgrade to v0.7.6, which removes the identified branches, updates `ctutils` to\ninclude its constant-time fixes, and adds BINSEC-based regression checks using\n`cargo checkct` for arithmetic on multiple targets.",
  "id": "RUSTSEC-2026-0387",
  "keywords": [],
  "patched_versions": [
    ">=0.7.6"
  ],
  "source": "debian_rustsec",
  "title": "Multiple timing variability issues in operations intended to be constant-time",
  "url": "https://github.com/RustCrypto/crypto-bigint/pull/1365"
}
View JSON API Download JSON