CVE-2014-8132: Double Free
Description of problem:
Maybe it is possible to send a malicious kexinit package to eventually cause a server to a double-free.
I guess this is only a DoS.
Source code:
http://git.libssh.org/projects/libssh.git/
Patch:
From f6b9f851b962e3a587f3f99b7cb97d130f0c77b9 Mon Sep 17 00:00:00 2001 From: Jon Simons <jon> Date: Sat, 18 Oct 2014 23:23:26 -0700 Subject: [PATCH] kex: fixup error path in sshpacketkexinit
Before this change, dangling pointers can be unintentionally left in the respective nextcrypto kex methods slots. Ensure to set all slots to NULL in the error-out path.
Signed-off-by: Jon Simons <jon> --- src/kex.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/src/kex.c b/src/kex.c index f1a1b56..ee00ec3 100644 --- a/src/kex.c +++ b/src/kex.c @@ -443,6 +443,11 @@ SSHPACKETCALLBACK(sshpacketkexinit){ error: sshstringfree(str); for (i = 0; i < SSHKEXMETHODS; i++) { + if (serverkex) { + session->nextcrypto->clientkex.methods[i] = NULL; + } else { / client / + session->nextcrypto->serverkex.methods[i] = NULL; + } SAFEFREE(strings[i]); } -- 1.9.1
Other sources
Double free vulnerability in the sshpacketkexinit function in kex.c in libssh 0.5.x and 0.6.x before 0.6.4 allows remote attackers to cause a denial of service via a crafted kexinit packet.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8132?
CVE-2014-8132 is classified as a denial of service vulnerability.
How do I fix CVE-2014-8132?
To fix CVE-2014-8132, update libssh to version 0.6.4 or later.
Which versions of libssh are affected by CVE-2014-8132?
CVE-2014-8132 affects libssh versions 0.5.0 through 0.6.3.
What type of attack does CVE-2014-8132 enable?
CVE-2014-8132 allows an attacker to send a malicious kexinit package that can lead to a denial of service.
Is CVE-2014-8132 a remote code execution vulnerability?
No, CVE-2014-8132 is not a remote code execution vulnerability; it is primarily a DoS issue.