In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server Reference: https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/ https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498 https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480 https://github.com/libssh2/libssh2/pull/402/commits/1c6fa92b77e34d089493fe6d3e2c6c8775858b94
Created libssh2 tracking bugs for this issue: Affects: fedora-all [bug 1766903] Created mingw-libssh2 tracking bugs for this issue: Affects: fedora-all [bug 1766904]
Created mingw-libssh2 tracking bugs for this issue: Affects: epel-7 [bug 1766905]
upstream commit: https://github.com/libssh2/libssh2/commit/dedcbd10
External References: https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
Analysis: This flaw needs a malicious MITM SSH server. When an application compiled with libssh2 connects to such a MITM SSH server, the server can trigger an integer overflow leading to an OOB read in the SSH_MSG_DISCONNECT logic. This can cause the application compiled with libssh2 to crash. This is strictly a client side crash and the SSH server may not be affected. Regarding "remote information disclosure" mentioned in https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/ , if the user connects to a malicious MITM server there is already a risk of disclosing password/keys irrespective of the flaw.
Statement: This flaw needs a malicious MITM SSH server. When an application compiled with libssh2 connects to such a MITM SSH server, the server can trigger an integer overflow leading to an OOB read in the SSH_MSG_DISCONNECT logic. This can cause the application compiled with libssh2 to crash. This is strictly a client side crash and the SSH server may not be affected. Also note that when a user connects to a malicious MITM server there is already a risk of disclosing password/keys irrespective of the flaw.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:3915 https://access.redhat.com/errata/RHSA-2020:3915
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-17498