- Reported
-
- Issued
-
- Package
-
russh
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#ssh
#packet-length
#allocation
#oom
- Aliases
-
- References
-
- CVSS Score
- 7.5
HIGH
- CVSS Details
-
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality Impact
- None
- Integrity Impact
- None
- Availability Impact
- High
- CVSS Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Patched
-
Description
When reading a packet, russh took the 4-byte packet length sent by the peer and sized its receive buffer from it without any upper bound. The length is fully controlled by the other side of the connection and is read before authentication, so an unauthenticated client can claim packets of up to about 4 GiB and make a server allocate that much memory per connection. A few such connections are enough to run the process out of memory.
From 0.44.1, lengths above 256 KiB are rejected with Error::PacketSize before the buffer is sized.
Advisory available under CC0-1.0
license.