Description of problem: Maybe it is possible to send a malicious kexinit package to eventually cause a server to a double-free. I guess this is only a DoS. Source code: http://git.libssh.org/projects/libssh.git/ Patch: From f6b9f851b962e3a587f3f99b7cb97d130f0c77b9 Mon Sep 17 00:00:00 2001 From: Jon Simons <jon> Date: Sat, 18 Oct 2014 23:23:26 -0700 Subject: [PATCH] kex: fixup error path in ssh_packet_kexinit Before this change, dangling pointers can be unintentionally left in the respective next_crypto kex methods slots. Ensure to set all slots to NULL in the error-out path. Signed-off-by: Jon Simons <jon> --- src/kex.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/kex.c b/src/kex.c index f1a1b56..ee00ec3 100644 --- a/src/kex.c +++ b/src/kex.c @@ -443,6 +443,11 @@ SSH_PACKET_CALLBACK(ssh_packet_kexinit){ error: ssh_string_free(str); for (i = 0; i < SSH_KEX_METHODS; i++) { + if (server_kex) { + session->next_crypto->client_kex.methods[i] = NULL; + } else { /* client */ + session->next_crypto->server_kex.methods[i] = NULL; + } SAFE_FREE(strings[i]); } -- 1.9.1
The patch was not complete: From 3ec6790970973e52de30de46f24e4658c1f2e29b Mon Sep 17 00:00:00 2001 From: Jon Simons <jon> Date: Sat, 18 Oct 2014 23:23:26 -0700 Subject: [PATCH] kex: fixup error path in ssh_packet_kexinit Before this change, dangling pointers can be unintentionally left in the respective next_crypto kex methods slots. Ensure to set all slots to NULL in the error-out path. Signed-off-by: Jon Simons <jon> Reviewed-by: Andreas Schneider <asn> --- src/kex.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/kex.c b/src/kex.c index f1a1b56..695929e 100644 --- a/src/kex.c +++ b/src/kex.c @@ -368,7 +368,7 @@ SSH_PACKET_CALLBACK(ssh_packet_kexinit){ for (i = 0; i < KEX_METHODS_SIZE; i++) { str = buffer_get_ssh_string(packet); if (str == NULL) { - break; + goto error; } rc = buffer_add_ssh_string(session->in_hashbuf, str); @@ -443,6 +443,11 @@ SSH_PACKET_CALLBACK(ssh_packet_kexinit){ error: ssh_string_free(str); for (i = 0; i < SSH_KEX_METHODS; i++) { + if (server_kex) { + session->next_crypto->client_kex.methods[i] = NULL; + } else { /* client */ + session->next_crypto->server_kex.methods[i] = NULL; + } SAFE_FREE(strings[i]); } -- 2.1.2
Ping!
This has been assigned CVE-2014-8132 and the planned disclosure date is December 19th.
This is fixed in libssh 0.6.4 and upstream describes it thus: """ This is an important SECURITY and maintenance release in order to address CVE-2014-8132 – Double free on dangling pointers in initial key exchange packet. libssh versions 0.5.1 and above could leave dangling pointers in the session crypto structures. It is possible to send a malicious kexinit package to eventually cause a server to do a double-free before this fix. This could be used for a Denial of Service attack. """ External References: http://www.libssh.org/2014/12/19/libssh-0-6-4-security-and-bugfix-release/
Created libssh tracking bugs for this issue: Affects: fedora-all [bug 1176145] Affects: epel-all [bug 1176146]
libssh-0.6.4-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.6.4-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.6.4-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.6.4-1.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.5.5-3.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
libssh-0.5.5-3.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.
I think this can be closed as fixed.