CVE-2024-58262: Curve25519 dalek :sub`/`Scalar52::sub` Vulnerability

LOW
Advisory Identifier: GHSA-x4gp-pqpj-f43q
Share
CVSS 2.9
CWE-203
Published
Advisory Summary

CVE-2024-58262 is a LOW (CVSS 2.9) :sub`/`scalar52::sub` vulnerability (CWE-203: Observable Discrepancy) affecting Curve25519 dalek libraries in the crates.io ecosystem. The issue involves :sub`/`scalar52::sub`. Remediation is available by upgrading affected packages to version 4.1.3.

CVE-2024-58262 at a Glance

CVE Identifier CVE-2024-58262
GHSA Identifier GHSA-x4gp-pqpj-f43q
Severity LOW
CVSS v3.1 Base Score 2.9
CWE Classification CWE-203: Observable Discrepancy
Affected Product Curve25519 dalek
Package Ecosystem crates.io
Published Date
Last Updated

Security Impact

CVSS: 2.9

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

Attack Vector Local (AV:L)
Attack Complexity High (AC:H)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2024-58262

To remediate this vulnerability, upgrade all affected Curve25519 dalek dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

curve25519-dalek fixed: 4.1.3 
Upgrade curve25519-dalek to 4.1.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for curve25519-dalek

How to Check if You Are Affected

To determine whether your application is affected by CVE-2024-58262, inspect your project dependencies for Curve25519 dalek:

inspect dependencies for curve25519-dalek

Analyze the terminal output to locate any version of Curve25519 dalek in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.1.3), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-203: Observable Discrepancy, where the product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor. In Curve25519 dalek, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Timing variability of any kind is problematic when working with potentially secret values such as elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a problem was recently discovered in `curve25519-dalek`. The `Scalar29::sub` (32-bit) and `Scalar52::sub` (64-bit) functions contained usage of a mask value inside a loop where LLVM saw an opportunity to insert a branch instruction (`jns` on x86) to conditionally bypass this code section when the mask value is set to zero as can be seen in godbolt: - 32-bit (see L106): https://godbolt.org/z/zvaWxzvqv - 64-bit (see L48): https://godbolt.org/z/PczYj7Pda A similar problem was recently discovered in the Kyber reference implementation: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ As discussed on that thread, one portable solution, which is also used in this PR, is to introduce a volatile read as an optimization barrier, which prevents the compiler from optimizing it away. The fix can be validated in godbolt here: - 32-bit: https://godbolt.org/z/jc9j7eb8E - 64-bit: https://godbolt.org/z/x8d46Yfah The problem was discovered and the solution independently verified by Alexander Wagner <alexander.wagner@aisec.fraunhofer.de> and Lea Themint <lea.thiemt@tum.de> using their DATA tool: https://github.com/Fraunhofer-AISEC/DATA

CVE-2024-58262 Affected Curve25519 dalek Versions

1 component(s)
Fixed Versions:
4.1.3
Product / Package Ecosystem Affected Versions Fixed Version
curve25519-dalek
 crates.io
< 4.1.3
4.1.3

References

NVD — CVE-2024-58262 NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-58262
Curve25519 dalek Source Repository REPOSITORY
https://github.com/dalek-cryptography/curve25519-dalek/pull/659
Security Fix Commit FIX COMMIT
https://github.com/dalek-cryptography/curve25519-dalek/commit/415892acf1cdf9161bd6a4c99bc2f4cb8fae5e6a
Curve25519 dalek Source Repository REPOSITORY
https://github.com/dalek-cryptography/curve25519-dalek
rustsec.org/advisories/rustsec-... WEB
https://rustsec.org/advisories/RUSTSEC-2024-0344.html

Frequently Asked Questions

What is CVE-2024-58262?
CVE-2024-58262 is a security vulnerability in Curve25519 dalek involving :sub`/`Scalar52::sub` under CWE-203: Observable Discrepancy.
Which Curve25519 dalek versions are affected?
Affected versions include releases prior to 4.1.3 across affected packages: curve25519-dalek.
What version fixes CVE-2024-58262?
Upgrading to 4.1.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is curve25519-dalek affected?
Yes, curve25519-dalek is affected in releases prior to 4.1.3. Upgrade your dependency to 4.1.3 or later.
What is the CVSS score of CVE-2024-58262?
CVE-2024-58262 has a CVSS v3.1 base score of 2.9 (LOW) with vector string CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
What CWE is associated with CVE-2024-58262?
CVE-2024-58262 is classified under CWE-203: Observable Discrepancy (The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.).
How can I check crates.io dependencies for CVE-2024-58262?
Run the dependency tree command: 'inspect dependencies for curve25519-dalek'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-x4gp-pqpj-f43q",
  "modified" : "2026-02-17T19:30:26Z",
  "published" : "2024-06-18T21:56:24Z",
  "aliases" : [ "CVE-2024-58262" ],
  "summary" : "curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub`",
  "details" : "Timing variability of any kind is problematic when working with  potentially secret values such as elliptic curve scalars, and such issues can potentially leak private keys and other secrets. Such a problem was recently discovered in `curve25519-dalek`.\n\nThe `Scalar29::sub` (32-bit) and `Scalar52::sub` (64-bit) functions contained usage of a mask value inside a loop where LLVM saw an opportunity to insert a branch instruction (`jns` on x86) to conditionally bypass this code section when the mask value is set to zero as can be seen in godbolt:\n\n- 32-bit (see L106): https://godbolt.org/z/zvaWxzvqv\n- 64-bit (see L48): https://godbolt.org/z/PczYj7Pda\n\nA similar problem was recently discovered in the Kyber reference implementation:\n\nhttps://groups.google.com/a/list.nist.gov/g/pqc-forum/c/hqbtIGFKIpU/m/cnE3pbueBgAJ\n\nAs discussed on that thread, one portable solution, which is also used in this PR, is to introduce a volatile read as an optimization barrier, which prevents the compiler from optimizing it away.\n\nThe fix can be validated in godbolt here:\n\n- 32-bit: https://godbolt.org/z/jc9j7eb8E\n- 64-bit: https://godbolt.org/z/x8d46Yfah\n\nThe problem was discovered and the solution independently verified by Alexander Wagner <alexander.wagner@aisec.fraunhofer.de> and Lea Themint <lea.thiemt@tum.de> using their DATA tool:\n\nhttps://github.com/Fraunhofer-AISEC/DATA",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "curve25519-dalek"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-58262"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dalek-cryptography/curve25519-dalek/pull/659"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/dalek-cryptography/curve25519-dalek/commit/415892acf1cdf9161bd6a4c99bc2f4cb8fae5e6a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/dalek-cryptography/curve25519-dalek"
  }, {
    "type" : "WEB",
    "url" : "https://rustsec.org/advisories/RUSTSEC-2024-0344.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-203" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-06-18T21:56:24Z",
    "nvd_published_at" : null
  }
}