Skip to content
Fencer Intel
low —

GHSA-3288-p39f-rqpv json

Unsoundness in opt-in ARMv8 assembly backend for `keccak`

published 9mo ago modified 2mo ago also RUSTSEC-2026-0012

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

The `asm!` block enabled by the off-by-default `asm` feature, when enabled on ARMv8 targets, misspecified the operand type for all of its operands, using `in` for pointers and values which were subsequently mutated by operations performed within the assembly block.

### Impact

It's unclear what practical impact, if any, this actually had. Incorrect operand types are technically undefined behavior, however changing them had no actual impact on the generated assembly for these targets. The possibility still exists that it may lead to potential memory safety or other issues on hypothetical future versions of rustc.

### Mitigation

The operand types were changed from `in` to `inout`, and the impacted versions of the `keccak` crate were yanked.

Patch / fix

  • crates.io keccak 0.1.6

Is GHSA-3288-p39f-rqpv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
crates.io keccak
<0.1.6
>=0.0.0-0, <0.1.6
0.1.6

Classification

Weakness
  • CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.