Bug 1908883 (CVE-2020-29652) - CVE-2020-29652 golang: crypto/ssh: crafted authentication request can lead to nil pointer dereference
Summary: CVE-2020-29652 golang: crypto/ssh: crafted authentication request can lead to...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-29652
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1909938 1909939 1909967 1909968 1909969 1909970 1909971 1909972 1909973 1909974 1910038 1910059 1910181 1910222 1910223 1910224 1910225 1910226 1910227 1910228 1910229 1910230 1910231 1910232 1910233 1910234 1910235 1910238 1910239 1910240 1910241 1910242 1910243 1910244 1910245 1910246 1910247 1910248 1910249 1910250 1910251 1910252 1910253 1910254 1910255 1910256 1910257 1910258 1910440 1910444 1910447 1910448 1927094 1927095
Blocks: 1908884
TreeView+ depends on / blocked
 
Reported: 2020-12-17 19:29 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-08-30 23:58 UTC (History)
64 users (show)

Fixed In Version: golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f
Doc Type: If docs needed, set a value
Doc Text:
A null pointer dereference vulnerability was found in golang. When using the library's ssh server without specifying an option for GSSAPIWithMICConfig, it is possible for an attacker to craft an ssh client connection using the `gssapi-with-mic` authentication method and cause the server to panic resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2021-02-24 19:02:17 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:5633 0 None None None 2021-02-24 15:10:43 UTC
Red Hat Product Errata RHSA-2021:0799 0 None None None 2021-03-10 11:16:00 UTC
Red Hat Product Errata RHSA-2021:2920 0 None None None 2021-07-27 14:19:28 UTC

Description Guilherme de Almeida Suckevicz 2020-12-17 19:29:59 UTC 
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Reference:
https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1

Upstream patch:
https://go-review.googlesource.com/c/crypto/+/278852
Comment 1 Mark Cooper 2020-12-22 02:26:29 UTC 
External References:

https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Comment 4 Mark Cooper 2020-12-22 07:35:11 UTC 
In general a majority of components depend on golang.org/x/crypto however to be considered affected here they must actually depend on golang.org/x/crypto/ssh and thus compile in crypto/ssh/server.go. 

If the component depends on golang.org/x/crypto/ssh/terminal only, then it is not considered here as the affected code is not compiled in. Depending on crypto/ssh/terminal will not compile in crypto/ssh/server.go.

Two ways to confirm this, 1. if using go mod, using `go list` will take this into account and not report crypto/ssh as a dependency even if used only in test, or 2, inspecting the binary with strings and looking for the file crypto/ssh/server.go.

Gopkg, I've not found an easy way to use it, have to only rely on it being present in the vendor directory.
Comment 22 Mark Cooper 2020-12-24 05:24:10 UTC 
Statement:

A large number of products include the affected package, but do not make use of the vulnerable SSH server code.  Accordingly, the flaw itself is rated as "Important", but these products themselves all have a "Low" severity rating.

Additionally, a number of products include golang.org/x/crypto (or even golang.org/x/crypto/ssh/terminal) but not specifically golang.org/x/crypto/ssh/server.go in the final build. As this would result in a very large number of entries of not affected products, only products which include the ssh server code (golang.org/x/crypto/ssh/server.go) have been represented here.  

Red Hat Enterprise Linux 8 container-tools:rhel8/containernetworking-plugins is not affected because although it uses some functionality from golang.org/x/crypto, it does not use or import anything from golang.org/x/crypto/ssh/*.
Comment 31 Mark Cooper 2021-02-10 03:45:03 UTC 
Created gomtree tracking bugs for this issue:

Affects: fedora-all [bug 1927095]


Created podman tracking bugs for this issue:

Affects: fedora-all [bug 1927094]
Comment 32 errata-xmlrpc 2021-02-24 15:10:38 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.7

Via RHSA-2020:5633 https://access.redhat.com/errata/RHSA-2020:5633
Comment 33 Product Security DevOps Team 2021-02-24 19:02:17 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-29652
Comment 34 errata-xmlrpc 2021-03-10 11:15:53 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-2.6

Via RHSA-2021:0799 https://access.redhat.com/errata/RHSA-2021:0799
Comment 35 errata-xmlrpc 2021-05-18 15:07:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:1796 https://access.redhat.com/errata/RHSA-2021:1796
Comment 36 errata-xmlrpc 2021-07-27 14:19:20 UTC 
This issue has been addressed in the following products:

  RHEL-8-CNV-4.8

Via RHSA-2021:2920 https://access.redhat.com/errata/RHSA-2021:2920
Note You need to log in before you can comment on or make changes to this bug.