Bug 1384860 (CVE-2016-8858) - CVE-2016-8858 openssh: Memory exhaustion due to unregistered KEXINIT handler after receiving message
Summary: CVE-2016-8858 openssh: Memory exhaustion due to unregistered KEXINIT handler ...
Status: NEW
Alias: CVE-2016-8858
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161017,repor...
Keywords: Security
: 1384566 1387116 (view as bug list)
Depends On:
Blocks: 1384863
TreeView+ depends on / blocked
 
Reported: 2016-10-14 09:49 UTC by Adam Mariš
Modified: 2016-10-21 10:52 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Adam Mariš 2016-10-14 09:49:41 UTC
A memory exhaustion issue in OpenSSH that can be triggered before user authentication was found. An unauthenticated attacker could consume approx. 400 MB of memory per each connection. The attacker could set up multiple such connections to run out of server’s memory.   

Affected versions: openssh-6.8p1, openssh-6.9p1, openssh-7.0p1, openssh-7.1p1, openssh-7.2p1, openssh-7.3p1. 

Upstream patch:

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/kex.c?rev=1.127&content-type=text/x-cvsweb-markup

Comment 1 Adam Mariš 2016-10-14 09:49:48 UTC
Acknowledgments:

Name: Shi Lei (Qihoo 360)

Comment 5 Huzaifa S. Sidhpurwala 2016-10-17 05:47:04 UTC
Analysis:

It seems the only thing the attacker could do here, is self-dos his own connection. Regarding consuming memory on the server, by opening several concurrent connections at the same time, there are various protections available in opensshd_config file, such as "MaxStartups", which can limit the maximum number of sessions per network connections. Based on this we do not consider this to be a security issue.


Statement:

The Red Hat Product Security Team does not consider this issue to be a security flaw, for more information please refer to https://bugzilla.redhat.com/show_bug.cgi?id=1384860#c5

Comment 6 Jakub Jelen 2016-10-17 07:42:14 UTC
*** Bug 1384566 has been marked as a duplicate of this bug. ***

Comment 7 Adam Mariš 2016-10-19 07:53:26 UTC
CVE request:

http://seclists.org/oss-sec/2016/q4/185

Comment 8 Andrej Nemec 2016-10-21 10:52:07 UTC
*** Bug 1387116 has been marked as a duplicate of this bug. ***

Comment 9 Andrej Nemec 2016-10-21 10:52:57 UTC
CVE assignment:

http://seclists.org/oss-sec/2016/q4/191


Note You need to log in before you can comment on or make changes to this bug.