[007bsd]

Both affected crates are unmaintained (see Checklist), so there is no upstream
maintainer to confirm the report or ship a fix. These advisories are filed for the
public record and to warn dependents via cargo audit. The defect is reported
upstream in the linked PRs below.

Affected crate(s)

• pqc_kyber (~14,800 recent downloads per crates.io, rolling ~90-day window)
• cosmian_kyber (stale fork of the same code; ~50 recent downloads, 0 dependents)

Links to upstream issue(s) or PR(s)

• pqc_kyber: Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Argyle-Software/kyber#121
• cosmian_kyber: Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Cosmian/kyber#6

Severity

Complete IND-CCA break (both crates carry the identical defect). The AVX2 cmov builds its blend mask with _mm256_set1_epi64x, so every byte's high bit is 0 and _mm256_blendv_epi8 copies nothing, making the routine a no-op. That cmov is the Fujisaki-Okamoto implicit-rejection step in decapsulation (called with len == 32, entirely through the vector loop), so on an invalid ciphertext the rejection value is never applied and the returned shared secret depends on the decrypted plaintext of the attacker-chosen ciphertext. This is a chosen-ciphertext plaintext-checking oracle and allows full recovery of a reused static secret key. Verified end to end on ML-KEM-768 (4,272 decapsulation queries, 0/768 coefficient mismatches, recovered key reproduces decryption on 64/64 random ciphertexts). Reachable only with the opt-in avx2 feature and a reused key pair; the default reference backend is correct. CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

Both crates are unmaintained: pqc_kyber's last release and commit are August 2023, and cosmian_kyber is a stale fork (last published January 2023). The defect is reported upstream in Argyle-Software/kyber#119 and Cosmian/kyber#5 (linked above); the maintainers are unresponsive, so a publishing confirmation could not be obtained.

[djc]

Thanks for reporting!

Have pinged maintainers in both upstream issues to see if we can clarify the status for these crates.

Feel free to ping me in a week if there's been no movement.

[007bsd]

Thanks @djc

Following up as suggested. There has been no response from the
maintainers on either upstream PR (Argyle-Software/kyber#121, Cosmian/kyber#6) since your pings.

What would you suggest as the next step?

[djc]

I have reached out to both maintainers by private email -- let's give it another week.

[007bsd]

Hi @djc, the week's up -- any word from the maintainers by email?

[djc]

I've heard from one of them. I think we can move forward with 4 advisories: one per crate for (1) the vulnerability and (2) it being unmaintained.

[007bsd]

Works for me. Happy to add the two unmaintained advisories to this PR so all four go in together, or leave them to you if that's easier. Whichever you prefer.

[djc]

Would be great if you can add them here!

[007bsd]

Quick note: the lint only accepts one RUSTSEC-0000-0000 placeholder per crate directory, so I couldn't drop the unmaintained advisories into these same dirs without an ID clash. Reverted them for now to get CI green. How would you like them handled: assign IDs in this PR, or a small follow-up PR? Files are ready either way.

[djc]

Quick note: the lint only accepts one RUSTSEC-0000-0000 placeholder per crate directory, so I couldn't drop the unmaintained advisories into these same dirs without an ID clash. Reverted them for now to get CI green. How would you like them handled: assign IDs in this PR, or a small follow-up PR? Files are ready either way.

You can have multiple draft advisories in the same dir. Just name them like RUSTSEC-0000-0000.0.md or something (varying the .0. part).

[007bsd]

Thanks, done, all four are in and lint is green

[djc]

Sorry, some more feedback on the actual advisories.

[007bsd]

Thanks. Done. Trimmed both vuln advisories to summary/impact/mitigation (details deferred to the linked PR) and moved the alternatives (aws-lc-rs, graviola) into the unmaintained advisories.

[djc]

Thanks for your patience & all the iterations!