In the gssapi.patch used in many Linux distributions, which adds GSSAPI-based key exchange support to OpenSSH, a vulnerability (CVE-2026-3497) has been identified, leading to pointer dereferencing, memory corruption, and bypassing of the privilege separation mechanism (Privsep). This vulnerability can be exploited remotely before authentication is performed. The researcher who identified the issue demonstrated the process crash by sending a modified network packet to the SSH server. It cannot be ruled out that, in addition to denial of service, there are more dangerous exploitation scenarios for this vulnerability.
Notably, the OpenSSH developers initially refused to include the change to support GSSAPI in the main codebase due to safety concerns. Nevertheless, many Linux distributions incorporated this patch into their OpenSSH packages. Several versions of the GSSAPI patch exist, but most contain a vulnerability-causing bug. The fix is currently available only as a patch, which involves replacing the sshpkt_disconnect() function call with ssh_packet_disconnect() in the kexgsss.c file.
Currently, the vulnerability has been confirmed in Debian and Ubuntu. For other distributions, the application of the problematic patch and its vulnerability is being investigated (SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora). The vulnerability only manifests when the 'GSSAPIKeyExchange yes' option is enabled in the settings. The ability to exploit it also depends on the compiler options used in the distributions to compile the package.
The cause of the vulnerability is an error in the sshpkt_disconnect() function, which caused the process not to terminate after receiving a disconnect message, allowing an attacker during the key agreement phase to send a type of GSSAPI message not defined by the logic of the process. server After receiving an unexpected GSSAPI message, server places it in queue and does not interrupt program execution, but at the same time does not initialize the variables that define the connection parameters. Later, in the event processing loop, the code executes, reading the uninitialized structure recv_tok from the stack (data leftover from the previous function call), sends it to the privileged process through IPC, and then passes it to the function gss_release_buffer(), which may call the free() function and free memory for an incorrect pointer referring to a random memory area.
Source: opennet.ru
