Rust advisories / ntru
Unsound MediumRUSTSEC-2023-0032 · ntru
RUSTSEC-2023-0032: Unsound FFI: Wrong API usage causes write past allocated area
Short answerntru has an API that can cause undefined behaviour from safe code: Unsound FFI: Wrong API usage causes write past allocated area. No fixed version yet.
| Crate | ntru |
|---|---|
| Type | Unsound (memory-corruption) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2023-03-22 |
| Last changed | 2023-11-08 |
| Also known as | GHSA-fq33-vmhv-48xh |
| Affected functions | ntru::types::PrivateKey::export, ntru::types::PublicKey::export |
What to do
- Find who pulls it in:
cargo tree -i ntru. - Avoid the affected API (
ntru::types::PrivateKey::export,ntru::types::PublicKey::export), or replace the crate.
Details from the advisory
The following usage causes undefined behavior.
let kp: ntru::types::KeyPair = …;
kp.get_public().export(Default::default())When compiled with debug assertions, the code above will trigger a attempt to subtract with overflow panic before UB occurs. Other mistakes (e.g. using EncParams from a different key) may always trigger UB.
Likely, older versions of this crate are also affected, but have not been tested.
References
- Package: crates.io/crates/ntru
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0032.html
- Report: github.com/FrinkGlobal/ntru-rs/issues/8
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?