chore(deps): update chacha20 to 0.10.2

[zulinx86]

Changes

• Update chacha20 from 0.10.1 to 0.10.2 by running cargo update --package chacha20@0.10.1.
• Remove the obsolete RUSTSEC-2026-0097 advisory ignore and its stale rationale from deny.toml.

Reason

Possible Impact

RustCrypto yanked chacha20 0.10.0 and 0.10.1 after issue #579 identified code that could require SSE4.1 while running on a path enabled for SSE2 hosts.

On an SSE2-only host, executing this path could raise an illegal-instruction exception and terminate the process. Version 0.10.2 fixes the CPU feature mismatch in PR #580.

Firecracker Dependency And Impact Assessment

The existing deny.toml rationale stated that uuid did not enable fast-rng or rng-rand. The current resolved feature graph contradicts that assumption:

vmm
  -> vhost 0.17.0
  -> uuid/fast-rng
  -> rand/default
  -> rand/std_rng
  -> chacha20/rng

Although the RNG implementation is enabled, vhost production code does not call random UUID generation. Its Uuid::new_v4() call sites are limited to test code, so Firecracker has no production call path to the affected ChaCha implementation.

Detailed supporting evidence is available in this investigation comment.

The RUSTSEC-2026-0097 ignore is also obsolete: the current graph no longer matches the advisory, and cargo deny check advisories reports zero errors and zero warnings without it.

Release Impact

This is not a guest-triggerable Firecracker vulnerability. Existing Firecracker releases do not require a patch release because production code cannot reach the affected path.

The dependency update is still required to remove a yanked crate from the lockfile and restore the nightly advisory check.

Testing

• tools/devtool --unattended test --no-build --no-kvm-check --no-artifacts-check -- integration_tests/security/test_sec_audit.py::test_cargo_audit
• tools/devtool --unattended checkstyle
• tools/devtool --unattended checkbuild --all

License Acceptance

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check CONTRIBUTING.md.

PR Checklist

• I have read and understand CONTRIBUTING.md.
• I have run tools/devtool checkbuild --all to verify that the PR passes build checks on all supported architectures.
• I have run tools/devtool checkstyle to verify that the PR passes the automated style checks.
• I have clearly described the change and why it is needed.
• Relevant documentation: not applicable.
• CHANGELOG.md: not applicable; no user-facing changes.
• Firecracker issue: not applicable.
• API change runbook: not applicable; no API changes.
• I have tested all changed functionality.
• New TODO entries: none.

---

• This functionality cannot be added in rust-vmm (not applicable; no functionality is added).

[zulinx86]

Detailed Dependency And Impact Investigation

1. Direct Requester Of chacha20/rng

The direct requester of chacha20/rng was identified by limiting the reverse dependency tree to depth 2:

tools/devtool --unattended sh \
    cargo tree --invert chacha20 --edges features --depth 2

chacha20 v0.10.2
└── chacha20 feature "rng"
    └── rand v0.10.2

This shows that rand 0.10.2 directly requests chacha20/rng.

cargo tree --invert accepts package specifications, not feature specifications. Attempting --invert chacha20/rng fails because / is not valid in a package name, so the causal feature within rand must be identified separately.

2. rand Feature Enabling chacha20

The rand manifest metadata was queried for features containing dep:chacha20:

tools/devtool --unattended sh cargo metadata --format-version 1 |
    jq --compact-output '
        .packages[]
        | select(.name == "rand" and .version == "0.10.2")
        | {
            rand_features_enabling_chacha20: (
                .features
                | to_entries
                | map(select(.value | index("dep:chacha20")))
                | from_entries
            )
        }
    '

{"rand_features_enabling_chacha20":{"chacha":["dep:chacha20"],"std_rng":["dep:chacha20"]}}

The candidate features were rand/chacha and rand/std_rng. The resolved feature tree was filtered to those candidates:

tools/devtool --unattended sh \
    cargo tree --invert rand@0.10.2 --edges features --depth 1 |
    grep --extended-regexp 'rand feature "(chacha|std_rng)"'

├── rand feature "std_rng"

rand/std_rng was resolved; rand/chacha was not.

3. Consumer Enabling rand/std_rng

The reverse tree was expanded without deduplication to identify the consumer of rand/std_rng:

tools/devtool --unattended sh \
    cargo tree --invert rand@0.10.2 --edges features --no-dedupe --depth 3

├── rand feature "std_rng"
│   ├── rand feature "default"
│   │   └── uuid v1.24.0
│   └── rand feature "thread_rng"
│       └── rand feature "default"

uuid enables rand/default, which enables rand/std_rng directly and through rand/thread_rng.

4. uuid Feature Enabling rand

The uuid manifest metadata was queried for features containing dep:rand:

tools/devtool --unattended sh cargo metadata --format-version 1 |
    jq --compact-output '
        .packages[]
        | select(.name == "uuid" and .version == "1.24.0")
        | {
            uuid_features_enabling_rand: (
                .features
                | to_entries
                | map(select(.value | index("dep:rand")))
                | from_entries
            )
        }
    '

{"uuid_features_enabling_rand":{"fast-rng":["rng","dep:rand"],"rng-rand":["rng","dep:rand","uuid-rng-internal-lib","uuid-rng-internal-lib/rand"]}}

The candidate features were uuid/fast-rng and uuid/rng-rand. The resolved feature tree was filtered to those candidates:

tools/devtool --unattended sh \
    cargo tree --invert uuid --edges features --depth 1 |
    grep --extended-regexp 'uuid feature "(fast-rng|rng-rand)"'

├── uuid feature "fast-rng"

uuid/fast-rng was resolved; uuid/rng-rand was not.

5. Consumer Enabling uuid/fast-rng

The reverse tree for uuid identified the consumer of uuid/fast-rng:

tools/devtool --unattended sh \
    cargo tree --invert uuid --edges features --depth 2

uuid v1.24.0
├── uuid feature "default"
│   └── vmm v0.1.0 (/firecracker/src/vmm)
│   [dev-dependencies]
│   └── clippy-tracing v0.1.0 (/firecracker/src/clippy-tracing)
├── uuid feature "fast-rng"
│   └── vhost v0.17.0
├── uuid feature "rng"
│   ├── uuid feature "fast-rng" (*)
│   └── uuid feature "v4"
│       [dev-dependencies]
├── uuid feature "std"
│   └── uuid feature "default" (*)
└── uuid feature "v4" (*)

vhost 0.17.0 enables uuid/fast-rng.

Resolved Dependency Path

The resolved dependency and feature-enablement path is:

vmm
  -> vhost 0.17.0
  -> uuid/fast-rng
  -> rand/default
  -> rand/std_rng
  -> chacha20/rng

This contradicts the existing deny.toml rationale that uuid does not enable fast-rng or rng-rand.

Runtime Reachability

The affected ChaCha RNG implementation is enabled in the dependency graph, but no production call path to it was found.

• vhost production code stores and forwards UUID values but does not generate random UUIDs.
• All Uuid::new_v4() calls in vhost 0.17.0 are inside #[cfg(test)] modules.
• Uuid::new_v4() reaches rand::random() through the enabled fast RNG implementation, but parsing or forwarding UUID values does not.
• No guest-controlled operation reaches random UUID generation.
• A guest cannot alter host CPU feature selection.

The investigation covered Firecracker, vhost, and uuid source call sites. It did not include runtime reproduction on an SSE2-only host, compiled-binary call-graph inspection, or dynamic instrumentation of all external dependencies.

Conclusion

The existing deny.toml rationale is stale because uuid/fast-rng is enabled through vhost. Firecracker is nevertheless unaffected because production code does not call random UUID generation and no guest-controlled operation reaches the affected ChaCha RNG path.

The upstream defect is therefore not guest-triggerable in Firecracker, and existing Firecracker releases do not require a patch release.

Updating to 0.10.2 remains necessary to remove the yanked dependency and restore the nightly advisory check.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.02%. Comparing base (f3f65a3) to head (afd2508).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #6160   +/-   ##
=======================================
  Coverage   83.01%   83.02%           
=======================================
  Files         277      277           
  Lines       30933    30933           
=======================================
+ Hits        25680    25681    +1     
+ Misses       5253     5252    -1     

Flag	Coverage Δ
5.10-m5n.metal	83.28% <ø> (-0.01%)	⬇️
5.10-m6a.metal	82.65% <ø> (-0.01%)	⬇️
5.10-m6g.metal	80.12% <ø> (+<0.01%)	⬆️
5.10-m6i.metal	83.28% <ø> (-0.01%)	⬇️
5.10-m7a.metal-48xl	82.63% <ø> (-0.01%)	⬇️
5.10-m7g.metal	80.12% <ø> (ø)
5.10-m7i.metal-24xl	83.25% <ø> (-0.01%)	⬇️
5.10-m7i.metal-48xl	83.25% <ø> (-0.01%)	⬇️
5.10-m8g.metal-24xl	80.11% <ø> (-0.01%)	⬇️
5.10-m8g.metal-48xl	80.11% <ø> (ø)
5.10-m8i.metal-48xl	83.25% <ø> (-0.01%)	⬇️
5.10-m8i.metal-96xl	83.26% <ø> (ø)
5.10-m9g.metal-48xl	80.11% <ø> (-0.01%)	⬇️
6.1-m5n.metal	83.31% <ø> (+<0.01%)	⬆️
6.1-m6a.metal	82.68% <ø> (ø)
6.1-m6g.metal	80.11% <ø> (-0.01%)	⬇️
6.1-m6i.metal	83.30% <ø> (-0.01%)	⬇️
6.1-m7a.metal-48xl	82.66% <ø> (ø)
6.1-m7g.metal	80.12% <ø> (ø)
6.1-m7i.metal-24xl	83.31% <ø> (-0.02%)	⬇️
6.1-m7i.metal-48xl	83.32% <ø> (-0.01%)	⬇️
6.1-m8g.metal-24xl	80.12% <ø> (ø)
6.1-m8g.metal-48xl	80.11% <ø> (ø)
6.1-m8i.metal-48xl	83.32% <ø> (-0.01%)	⬇️
6.1-m8i.metal-96xl	83.32% <ø> (-0.01%)	⬇️
6.1-m9g.metal-48xl	80.11% <ø> (ø)
6.18-m5n.metal	83.30% <ø> (-0.01%)	⬇️
6.18-m6a.metal	82.67% <ø> (ø)
6.18-m6g.metal	80.14% <ø> (ø)
6.18-m6i.metal	83.31% <ø> (+<0.01%)	⬆️
6.18-m7a.metal-48xl	82.66% <ø> (ø)
6.18-m7g.metal	80.14% <ø> (ø)
6.18-m7i.metal-24xl	83.32% <ø> (-0.01%)	⬇️
6.18-m7i.metal-48xl	83.31% <ø> (-0.02%)	⬇️
6.18-m8g.metal-24xl	80.13% <ø> (-0.01%)	⬇️
6.18-m8g.metal-48xl	80.13% <ø> (-0.01%)	⬇️
6.18-m8i.metal-48xl	83.32% <ø> (ø)
6.18-m8i.metal-96xl	83.32% <ø> (ø)
6.18-m9g.metal-48xl	80.14% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.