Executive brief
The RustCrypto cmov library provides specialized code to ensure certain operations happen in a fixed amount of time, which is critical for security and cryptography. A bug in the version for ARM64 (aarch64) processors can cause these operations to return incorrect results when processing specific data types. This could lead to logic errors or security failures in applications that rely on this library for cryptographic calculations.
Technical details
The aarch64 implementation of Cmov and CmovEq in the RustCrypto cmov crate (specifically in cmov/src/backends/aarch64.rs) incorrectly assumes that high bits are zero-extended when loading values smaller than a register. According to the Rust reference for inline assembly, upper bits of a register have undefined values for inputs smaller than the register size. If high bits (e.g., bits [8..] for Cmov or [16..] for u16/i16 CmovEq) are set in the input register, the internal assembly comparison (CMP) may evaluate incorrectly, causing the conditional select (CSEL) to produce the wrong output. This issue affects versions 0.1.1 through 0.5.3 and is fixed in version 0.5.4.
Affected products
- RustCrypto cmov >= 0.1.1, < 0.5.4
Timeline
- 2026-05-28: patched: Version 0.5.4 released with fix.
- 2026-07-17: disclosed: CVE-2026-50185 published.