CVE-2026-22698

Katalog CVE

CVSS 7.5 · High EPSS 0,27%

Kerentanan Insufficient Entropy pada rustcrypto sm2 elliptic curve. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

RustCrypto: Elliptic Curves is general purpose Elliptic Curve Cryptography (ECC) support, including types and traits for representing various elliptic curve forms, scalars, points, and public/secret keys composed thereof. In versions 0.14.0-pre.0 and 0.14.0-rc.0, a critical vulnerability exists in the SM2 Public Key Encryption (PKE) implementation where the ephemeral nonce k is generated with severely reduced entropy. A unit mismatch error causes the nonce generation function to request only 32 bits of randomness instead of the expected 256 bits. This reduces the security of the encryption from a 128-bit level to a trivial 16-bit level, allowing a practical attack to recover the nonce k and decrypt any ciphertext given only the public key and ciphertext. This issue has been patched via commit e4f7778.

Rincian

Terbit di NVD

10 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-331: Insufficient Entropy

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 18,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/RustCrypto/elliptic-curves/security/advisories/GHSA-w3g8-fp6j-wvqw exploit · mitigasi · advisory vendor
• https://github.com/RustCrypto/elliptic-curves/commit/4781762f23ff22ab34763410f648128055c93731 patch
• https://github.com/RustCrypto/elliptic-curves/commit/e4f77788130d065d760e57fb109370827110a525 patch
• https://github.com/RustCrypto/elliptic-curves/pull/1600 issue tracking · patch
• https://crates.io/crates/sm2/0.14.0-pre.0 release notes
• https://crates.io/crates/sm2/0.14.0-rc.0 release notes