RustCrypto SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()

Vulnerability

Overview

A denial-of-service vulnerability exists in the SM2 PKE decryption path of the RustCrypto sm2 crate (part of the elliptic-curves repository). Versions 0.14.0-pre.0 and 0.14.0-rc.0 are affected [1][2]. The bug resides in the internal decrypt() function within src/pke/decrypting.rs. When decoding the C1 elliptic-curve point from a ciphertext, the code calls AffinePoint::from_encoded_point(&encoded_c1), which returns a CtOption. If the provided coordinates are syntactically valid (correct SEC1 encoding and length) but do not actually lie on the SM2 curve, the function returns None. The calling code then invokes .unwrap() on this potentially None value, causing a panic [2][4].

Exploitation

Scenario

An attacker can exploit this by crafting a ciphertext (e.g., as ASN.1 DER) where the C1 field contains arbitrary 32-byte X and Y values that satisfy the encoding format but are not on the SM2 curve. Such input passes the initial EncodedPoint::from_bytes() validation, which only checks format, not mathematical validity. When decrypt_der() or decrypt() processes this crafted ciphertext, the unwrap() call triggers a panic, crashing the decryption operation [2]. No authentication is required beyond the ability to submit ciphertext to a vulnerable SM2 decryption endpoint.

Impact

Successful exploitation results in a panic (unexpected termination) of the decryption process, leading to a denial-of-service condition. The confidentiality of encrypted data is not directly compromised, but the service becomes unavailable [1][2].

Mitigation

The vulnerability has been patched in commit 085b7be [1][4]. The fix replaces the unwrap() with proper error propagation by converting the CtOption into a Result and returning an error, preventing the panic [4]. Users should update to a patched version (e.g., the commit or any subsequent release containing the fix). No workarounds are mentioned in the advisories.