Rust advisories / sharks
Vulnerability MediumRUSTSEC-2024-0398 · sharks
RUSTSEC-2024-0398: Bias of Polynomial Coefficients in Secret Sharing
Short answerA security vulnerability in the sharks crate: Bias of Polynomial Coefficients in Secret Sharing. GitHub rates it Medium. No fixed version: replace the crate or remove the affected code path.
| Crate | sharks |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Every version. |
| Fixed in | none |
| Severity | Medium (GitHub rating) |
| Published | 2024-11-16 |
| Last changed | 2025-10-28 |
| Also known as | GHSA-jp37-5qhw-mffw |
What to do
- Find who pulls it in:
cargo tree -i sharks. - Avoid the affected API, or replace the crate.
Details from the advisory
Affected versions of this crate allowed for a bias when generating random polynomials for Shamir Secret Sharing, where instead of being within the range [0, 255] they were instead in the range [1, 255]. A description from Cure53, who originally found the issue, is available:
> The correct method to select a random polynomial would be to select all coefficients (including the most significant coefficient) uniformly in the range 0..255 (inclusive). Otherwise, knowledge that a coefficient in a polynomial cannot be 0 permits the exclusion of single byte values for the shared secret given one share less than required. [...] Exploiting this weakness necessitates sharing the same secret multiple times. In this scenario, an attacker could exclude an exponential number of values for each of the shared bytes until sufficiently few values remain for brute forcing. Cure53 estimates that under ideal circumstances (e.g., a 2-out-of-N scheme) a shared secret can be reconstructed if the same secret has been distributed 500-1500 times.
Secrets that have been shared a low amount of times (ideally, once) would not be impacted. However, secrets that are repeatedly shared may be vulnerable, especially if the shares are still available, and should be rotated.
The vulnerability does not impact reconstitution of secrets: secrets that have already been split can be recombined without issue.
The flaw can be corrected by changing the lower bound of the polynomial coefficient range in the sharks::math::random_polynomial function to 0. The blahaj crate has been made available with a fixed version of the code, after attempts to reach the maintainer of the sharks crate were unsuccessful.
References
- Package: crates.io/crates/sharks
- Advisory: rustsec.org/advisories/RUSTSEC-2024-0398.html
- Web: git.distrust.co/public/blahaj/commit/4faab1cd33d455f0ca2ccc7208093fd6c18e0767
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?