Orion: LLVM introduces timing-vulnerable optimizations into ML-KEM and ML-DSA operations intended to be constant-time
Affects orionSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 0.18.1, 0.17.16
Data as of 30 Oct 2026, 12:22 UTC
What to do
Upgrade orion to 0.18.1 or 0.17.16.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
crates.ioorionpkg:cargo/orionOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade Orion to version 0.17.16 or 0.18.1, where conditional_sub_u32() has been rewritten to avoid timing-vulnerable conditional jumps by considering the availability of conditional move/jump instructions. Applying these updates fully mitigates the vulnerability.
Description
LLVM's compilation of the internal function conditional_sub_u32() in the Orion cryptographic library introduces timing-vulnerable conditional jumps on certain CPU targets lacking conditional move/select instructions. This affects ML-KEM and ML-DSA cryptographic operations, potentially leaking secret-dependent information. The issue impacts specific Linux targets including i586, s390x, and x86_64 architectures. The vulnerability could enable recovery of cryptographic keys depending on the compiler, CPU, and attacker proximity. Fixed versions 0.17.16 and 0.18.1 address this by rewriting conditional_sub_u32() to consider conditional move/jump availability.