The release of OpenSSH 9.2 has been announced, an open-source implementation of the client and server for SSH 2.0 and SFTP protocols. This new version fixes a vulnerability that leads to double freeing of memory before authentication is complete. Only OpenSSH 9.1 is affected; earlier versions do not exhibit this issue.
To create conditions for the vulnerability to manifest, it is enough to change the SSH client banner to 'SSH-2.0-FuTTYSH_9.1p1' in order to set the flags 'SSH_BUG_CURVE25519PAD' and 'SSH_OLD_DHGEX', which depend on the version of the SSH client. Once these flags are set, memory for the 'options.kex_algorithms' buffer is freed twice — during the execution of the do_ssh2_kex() function, which calls compat_kex_proposal(), and during the execution of the do_authentication2() function, which in turn calls input_userauth_request(), mm_getpwnamallow(), copy_set_server_options(), assemble_algorithms(), and kex_assemble_names().
Creating a working exploit for the vulnerability is considered unlikely, as the exploitation process is too complicated — modern memory allocation libraries provide protection against double freeing of memory, and the pre-auth process, where the error occurs, runs with reduced privileges in an isolated sandbox environment.
In addition to the noted vulnerability, this release also addresses two more security issues:
- An error in processing the 'PermitRemoteOpen' setting leads to the first argument being ignored if it differs from the values 'any' and 'none'. This issue appears in versions newer than OpenSSH 8.7 and causes a bypass of checks when only one privilege is specified.
- An attacker controlling the DNS server used for name resolution can achieve the substitution of special characters (for example, '*') in the known_hosts file if the options CanonicalizeHostname and CanonicalizePermittedCNAMEs are enabled in the configuration, and the system resolver does not verify the correctness of the responses from the DNS server. Conducting such an attack is considered unlikely, as the returned names must comply with the conditions set by CanonicalizePermittedCNAMEs.
Other changes:
- In ssh_config for ssh, a setting called EnableEscapeCommandline has been added, controlling the handling of the client-side escape sequence «~C», which provides a command line interface. By default, the handling of «~C» is now disabled to enforce stricter sandbox isolation, which may potentially disrupt systems where «~C» is used for port forwarding during operation.
- In sshd_config for sshd, the ChannelTimeout directive has been added to specify the inactivity timeout for channels (channels that have no recorded traffic during the time specified in the directive will be automatically closed). Different timeouts can be set for the session, X11, agent, and traffic redirection.
- In sshd_config for sshd, the UnusedConnectionTimeout directive has been added, allowing the setting of a timeout for terminating client connections that remain inactive for a specified period without active channels.
- An option «-V» has been added to sshd to output the version, similar to a corresponding option in the ssh client.
- A line «Host» indicating the value of the hostname argument has been added to the output of «ssh -G».
- In scp and sftp, the option «-X» has been added to control SFTP protocol parameters, such as the copy buffer size and the number of outstanding requests.
- In ssh-keyscan, scanning of full CIDR address ranges is allowed, for example, «ssh-keyscan 192.168.0.0/24».
Source: opennet.ru
