V pou\u017e\u00edvan\u00e9m patche gssapi.patch, kter\u00fd v OpenSSH p\u0159id\u00e1v\u00e1 podporu pro v\u00fdm\u011bnu kl\u00ed\u010d\u016f na z\u00e1klad\u011b GSSAPI, byla odhalena zranitelnost (CVE-2026-3497), kter\u00e1 vede k dereferencov\u00e1n\u00ed ukazatele, po\u0161kozen\u00ed pam\u011bti a obch\u00e1zen\u00ed mechanismu odd\u011blen\u00ed opr\u00e1vn\u011bn\u00ed (Privsep). Tuto zranitelnost je mo\u017en\u00e9 zneu\u017e\u00edt vzd\u00e1len\u011b p\u0159ed proveden\u00edm autentizace. V\u00fdzkumn\u00edk, kter\u00fd probl\u00e9m odhalil, demonstroval iniciaci hav\u00e1rie procesu zasl\u00e1n\u00edm jednoho modifikovan\u00e9ho s\u00ed\u0165ov\u00e9ho paketu na SSH server. Nen\u00ed vylou\u010deno, \u017ee krom\u011b odm\u00edtnut\u00ed slu\u017eby existuj\u00ed i nebezpe\u010dn\u011bj\u0161\u00ed mo\u017enosti zneu\u017eit\u00ed zranitelnosti. <\/p>\n
Je pozoruhodn\u00e9, \u017ee v minulosti v\u00fdvoj\u00e1\u0159i OpenSSH odm\u00edtli p\u0159ijmout zm\u011bnu pro podporu GSSAPI do hlavn\u00edho k\u00f3du kv\u016fli pochybnostem o jej\u00ed bezpe\u010dnosti. Nicm\u00e9n\u011b mnoho linuxov\u00fdch distribuc\u00ed tento patch za\u0159adilo do sv\u00fdch OpenSSH bal\u00ed\u010dk\u016f. V praxi existuje n\u011bkolik verz\u00ed GSSAPI-patche, ale v\u011bt\u0161ina z nich obsahuje chybu vedouc\u00ed k zranitelnosti. Oprava je zat\u00edm dostupn\u00e1 pouze ve form\u011b patchu, jeho\u017e zm\u011bny spo\u010d\u00edvaj\u00ed v nahrazen\u00ed vol\u00e1n\u00ed funkce sshpkt_disconnect() funkc\u00ed ssh_packet_disconnect() v souboru kexgsss.c. <\/p>\n
V sou\u010dasn\u00e9 dob\u011b byla zranitelnost potvrzena v Debianu a Ubuntu. U ostatn\u00edch distribuc\u00ed se uplatn\u011bn\u00ed problematick\u00e9ho patche a jeho n\u00e1chylnost k zranitelnosti up\u0159es\u0148uje (SUSE\/openSUSE, RHEL, Gentoo, Arch, Fedora). Zranitelnost se projevuje pouze p\u0159i zapnut\u00ed mo\u017enosti nastaven\u00ed \u201eGSSAPIKeyExchange yes\u201c. Na mo\u017enost jej\u00edho zneu\u017eit\u00ed tak\u00e9 maj\u00ed vliv volby p\u0159eklada\u010de, se kter\u00fdmi byly bal\u00ed\u010dky v distribuc\u00edch sestavov\u00e1ny. <\/p>\n
P\u0159\u00ed\u010dinou vzniku zranitelnosti je chyba ve funkci sshpkt_disconnect(), kv\u016fli n\u00ed\u017e proces nebyl ukon\u010den po p\u0159ijet\u00ed disconnect zpr\u00e1vy, co\u017e \u00fato\u010dn\u00edkovi umo\u017e\u0148ovalo v pr\u016fb\u011bhu dojedn\u00e1v\u00e1n\u00ed kl\u00ed\u010d\u016f zaslat logikou nepl\u00e1novanou GSSAPI zpr\u00e1vu. serveru<\/a> typ GSSAPI zpr\u00e1vy. Po p\u0159ijet\u00ed mimo\u0159\u00e1dn\u00e9 GSSAPI zpr\u00e1vy, server<\/a> um\u00edst\u00ed jej do fronty a nep\u0159eru\u0161\u00ed prov\u00e1d\u011bn\u00ed programu, ale z\u00e1rove\u0148 neinitializuje prom\u011bnn\u00e9, kter\u00e9 ur\u010duje parametry p\u0159ipojen\u00ed. N\u00e1sledn\u011b v cyklu zpracov\u00e1n\u00ed ud\u00e1lost\u00ed se prov\u00e1d\u00ed k\u00f3d, kter\u00fd \u010dte neinicializovanou strukturu recv_tok ze z\u00e1sobn\u00edku (\u010dtou se data ponechan\u00e1 v z\u00e1sobn\u00edku z p\u0159edchoz\u00edho vol\u00e1n\u00ed funkce), odes\u00edl\u00e1 ji privilegovan\u00e9mu procesu p\u0159es IPC a pot\u00e9 p\u0159ed\u00e1 do funkce gss_release_buffer(), kter\u00e1 m\u016f\u017ee zavolat funkci free() a uvolnit pam\u011b\u0165 pro neplatn\u00fd ukazatel odkazuj\u00edc\u00ed na n\u00e1hodnou oblast pam\u011bti. \u0412 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux \u043f\u0430\u0442\u0447\u0435 gssapi.patch, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 OpenSSH \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 GSSAPI, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3497), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (Privsep). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043d\u0430 SSH-\u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-164054","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v GSSAPI patchi pro OpenSSH, vzd\u00e1len\u011b zneu\u017eiteln\u00e1 p\u0159ed autentizac\u00ed | ProHoster","description":"Ve vyu\u017e\u00edvan\u00e9m v mnoha distribuc\u00edch Linuxu patchi gssapi.patch, kter\u00fd p\u0159id\u00e1v\u00e1 do OpenSSH podporu pro v\u00fdm\u011bnu kl\u00ed\u010d\u016f zalo\u017eenou na GSSAPI, byla zji\u0161t\u011bna zranitelnost (CVE-2026-3497), kter\u00e1 vede k dereferencov\u00e1n\u00ed ukazatele a po\u0161kozen\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GSSAPI-\u043f\u0430\u0442\u0447\u0435 \u043a OpenSSH, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux \u043f\u0430\u0442\u0447\u0435 gssapi.patch, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 OpenSSH \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 GSSAPI, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3497), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-13T09:12:02+00:00","article:modified_time":"2026-03-13T09:12:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/164054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=164054"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/164054\/revisions"}],"predecessor-version":[{"id":173149,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/164054\/revisions\/173149"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=164054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=164054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=164054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"