Add advisories for pqc_kyber and cosmian_kyber (AVX2 cmov skips FO implicit rejection, key recovery)

[007bsd]

Both affected crates are unmaintained (see Checklist), so there is no upstream
maintainer to confirm the report or ship a fix. These advisories are filed for the
public record and to warn dependents via cargo audit. The defect is reported
upstream in the linked PRs below.

Affected crate(s)

• pqc_kyber (~14,800 recent downloads per crates.io, rolling ~90-day window)
• cosmian_kyber (stale fork of the same code; ~50 recent downloads, 0 dependents)

Links to upstream issue(s) or PR(s)

• pqc_kyber: Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Argyle-Software/kyber#121
• cosmian_kyber: Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Cosmian/kyber#6

Severity

Complete IND-CCA break (both crates carry the identical defect). The AVX2 cmov builds its blend mask with _mm256_set1_epi64x, so every byte's high bit is 0 and _mm256_blendv_epi8 copies nothing, making the routine a no-op. That cmov is the Fujisaki-Okamoto implicit-rejection step in decapsulation (called with len == 32, entirely through the vector loop), so on an invalid ciphertext the rejection value is never applied and the returned shared secret depends on the decrypted plaintext of the attacker-chosen ciphertext. This is a chosen-ciphertext plaintext-checking oracle and allows full recovery of a reused static secret key. Verified end to end on ML-KEM-768 (4,272 decapsulation queries, 0/768 coefficient mismatches, recovered key reproduces decryption on 64/64 random ciphertexts). Reachable only with the opt-in avx2 feature and a reused key pair; the default reference backend is correct. CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

Both crates are unmaintained: pqc_kyber's last release and commit are August 2023, and cosmian_kyber is a stale fork (last published January 2023). The defect is reported upstream in Argyle-Software/kyber#119 and Cosmian/kyber#5 (linked above); the maintainers are unresponsive, so a publishing confirmation could not be obtained.