RustCrypto utils implements the Cmov and CmovEq intrinsics to guarantee constant‑time behavior across major platforms. In versions 0.1.1 through 0.5.4, the aarch64 backend incorrectly assumes that sub‑register loads are zero‑extended, allowing high bits beyond the intended width to influence the selector or operand values. As a result, calls to left.cmovz(&right, condition) can return an incorrect value when high bits such as [8..] in the selector or [16..] of the operands are set. This defect compromises the library’s constant‑time guarantees and is identified as a failure to behave correctly (CWE‑758).

The issue affects RustCrypto’s utils library, specifically the cmov module on aarch64 processors. Any installation of the library from release 0.1.1 up to and including 0.5.4 is vulnerable when user code imports these intrinsics on an aarch64 architecture. The vulnerability does not expand beyond the immediate library; it does not impact other platforms or versions.

The CVSS score of 2.0 indicates a low severity impact. The EPSS score of less than 1% suggests that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is code that imports the affected library on an aarch64 system and supplies values with high bits set to the Cmov/CmovEq functions, thereby producing incorrect results rather than causing a crash or privilege escalation. Because the consequence is incorrect calculations rather than a systemic compromise, the risk to confidentiality, integrity, or availability is minimal. Applying the vendor’s fix in version 0.5.4 or later eliminates the flaw.