Threats affecting pkg:cargo/orion

The Orion library's BLAKE2b implementation has a flaw in the reset() function when used with a key of different length than the original initialization key. This causes the computed BLAKE2b tag to be incorrect, leading to verification failures during normal protocol operations. The issue is fixed in versions 0.17.16 and 0.18.1.

LLVM's compilation of the internal function conditional_sub_u32() in the Orion cryptographic library introduces timing-vulnerable conditional jumps on certain CPU targets lacking conditional move/select instructions. This affects ML-KEM and ML-DSA cryptographic operations, potentially leaking secret-dependent information. The issue impacts specific Linux targets including i586, s390x, and x86_64 architectures. The vulnerability could enable recovery of cryptographic keys depending on the compiler, CPU, and attacker proximity. Fixed versions 0.17.16 and 0.18.1 address this by rewriting conditional_sub_u32() to consider conditional move/jump availability.