{"id":164054,"date":"2026-03-13T11:12:02","date_gmt":"2026-03-13T09:12:02","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii"},"modified":"2026-03-13T11:12:02","modified_gmt":"2026-03-13T09:12:02","slug":"uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","title":{"rendered":"Zranite\u013enos\u0165 v GSSAPI patche pre OpenSSH, zneu\u017eite\u013en\u00e1 na dia\u013eku pred autentifik\u00e1ciou","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V patchi gssapi.patch, ktor\u00fd sa pou\u017e\u00edva v mnoh\u00fdch distrib\u00faci\u00e1ch Linuxu a prid\u00e1va podporu pre v\u00fdmenu k\u013e\u00fa\u010dov na b\u00e1ze GSSAPI do OpenSSH, bola identifikovan\u00e1 zranite\u013enos\u0165 (CVE-2026-3497), ktor\u00e1 vedie k dereferencovaniu ukazovate\u013ea, po\u0161kodeniu pam\u00e4te a obch\u00e1dzaniu mechanizmu oddelenia privil\u00e9gi\u00ed (Privsep). Zranite\u013enos\u0165 m\u00f4\u017ee by\u0165 zneu\u017eit\u00e1 na dia\u013eku pred realiz\u00e1ciou autentifik\u00e1cie. V\u00fdskumn\u00edk, ktor\u00fd identifikoval probl\u00e9m, demon\u0161troval iniciovanie hav\u00e1rie procesu prostredn\u00edctvom zaslania jedn\u00e9ho modifikovan\u00e9ho sie\u0165ov\u00e9ho paketu na SSH server. Nie je vyl\u00fa\u010den\u00e9, \u017ee okrem odmietnutia slu\u017eby existuj\u00fa aj nebezpe\u010dnej\u0161ie varianty zneu\u017eitia tejto zranite\u013enosti. <\/p>\n

Zauj\u00edmav\u00e9 je, \u017ee v minulosti sa v\u00fdvoj\u00e1ri OpenSSH rozhodli neprija\u0165 zmenu na podporu GSSAPI do hlavnej verzie kv\u00f4li pochybnostiam o jej bezpe\u010dnosti. Napriek tomu mnoh\u00e9 distrib\u00facie Linuxu zahrnuli tento patch do svojich bal\u00edkov s OpenSSH. Existuje nieko\u013eko verzi\u00ed GSSAPI patcha, ale vo v\u00e4\u010d\u0161ine z nich je pr\u00edtomn\u00e1 chyba ved\u00faca k zranite\u013enosti. Oprava je zatia\u013e dostupn\u00e1 len vo forme patcha, ktor\u00fd spo\u010d\u00edva v zamene volania funkcie sshpkt_disconnect() na ssh_packet_disconnect() v s\u00fabore kexgsss.c. <\/p>\n

V s\u00fa\u010dasnosti je zranite\u013enos\u0165 potvrden\u00e1 v Debian a Ubuntu. V ostatn\u00fdch distrib\u00faci\u00e1ch sa preveruje aplik\u00e1cia problematick\u00e9ho patchu a jeho zranite\u013enos\u0165 (SUSE\/openSUSE, RHEL, Gentoo, Arch, Fedora). Zranite\u013enos\u0165 sa prejavuje iba pri aktivovanej vo\u013ebe \u201eGSSAPIKeyExchange yes\u201c v nastaveniach. Na mo\u017enos\u0165 zneu\u017eitia maj\u00fa tie\u017e vplyv mo\u017enosti kompil\u00e1tora, s ktor\u00fdmi bol bal\u00edk zostaven\u00fd v distrib\u00faci\u00e1ch. <\/p>\n

Pr\u00ed\u010dinou vzniku zranite\u013enosti je chyba vo funkcii sshpkt_disconnect(), kv\u00f4li ktorej proces neukon\u010dil \u010dinnos\u0165 po prijat\u00ed disconnect spr\u00e1vy, \u010do umo\u017enilo \u00fato\u010dn\u00edkovi v \u0161t\u00e1diu vyjedn\u00e1vania k\u013e\u00fa\u010dov posla\u0165 nespr\u00e1vny typ GSSAPI spr\u00e1vy. Po prijat\u00ed neo\u010dak\u00e1vanej GSSAPI spr\u00e1vy, servera<\/a> ... server<\/a> umiest\u0148uje ho do fronty a nepretrhne vykon\u00e1vanie programu, ale z\u00e1rove\u0148 neiniitializuje premenn\u00e9 ur\u010duj\u00face parametre pripojenia. N\u00e1sledne v cykle spracovania udalost\u00ed vykon\u00e1va k\u00f3d, ktor\u00fd \u010d\u00edta neinicializovan\u00fa \u0161trukt\u00faru recv_tok zo z\u00e1sobn\u00edka (\u010d\u00edtaj\u00fa sa d\u00e1ta, ktor\u00e9 zostali v z\u00e1sobn\u00edku z predch\u00e1dzaj\u00faceho volania funkcie), posiela ju privilegovan\u00e9mu procesu prostredn\u00edctvom IPC a potom ju odovzd\u00e1va funkcii gss_release_buffer(), ktor\u00e1 m\u00f4\u017ee vyvola\u0165 funkciu free() a uvo\u013eni\u0165 pam\u00e4\u0165 pre neplatn\u00fd ukazovate\u013e, ktor\u00fd odkazuje na n\u00e1hodn\u00fa oblas\u0165 pam\u00e4te.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux \u043f\u0430\u0442\u0447\u0435 gssapi.patch, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 OpenSSH \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 GSSAPI, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3497), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043e\u0431\u0445\u043e\u0434\u0443 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0440\u0430\u0437\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 (Privsep). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0412\u044b\u044f\u0432\u0438\u0432\u0448\u0438\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043d\u0430 SSH-\u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0434\u043d\u043e\u0433\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-164054","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v GSSAPI patche pre OpenSSH, ktor\u00e1 je vzdialene zneu\u017eite\u013en\u00e1 v \u0161t\u00e1diu pred autentifik\u00e1ciou | ProHoster","description":"V aplikovanom vo viacer\u00fdch distrib\u00faci\u00e1ch Linuxe patchi gssapi.patch, ktor\u00fd prid\u00e1va do OpenSSH podporu pre v\u00fdmenu k\u013e\u00fa\u010dov zalo\u017een\u00fa na GSSAPI, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2026-3497), ktor\u00e1 vedie k dereferencovaniu ukazovate\u013ea a po\u0161kodeniu.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 GSSAPI-\u043f\u0430\u0442\u0447\u0435 \u043a OpenSSH, \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u0434\u043e \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"\u0412 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 Linux \u043f\u0430\u0442\u0447\u0435 gssapi.patch, \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u043c \u0432 OpenSSH \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0443 \u043e\u0431\u043c\u0435\u043d\u0430 \u043a\u043b\u044e\u0447\u0435\u0439 \u043d\u0430 \u0431\u0430\u0437\u0435 GSSAPI, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-3497), \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0440\u0430\u0437\u044b\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f, \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-gssapi-patche-k-openssh-udalyonno-ekspluatiruemaya-na-stadii-do-autentifikaczii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-13T09:12:02+00:00","article:modified_time":"2026-03-13T09:12:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/164054","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=164054"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/164054\/revisions"}],"predecessor-version":[{"id":173149,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/164054\/revisions\/173149"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=164054"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=164054"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=164054"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}