CVE-2022-21716: Buffer Overflow in Twisted
Impact
The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.
A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as nc -rv localhost 22 < /dev/zero.
Patches
The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
A fix is available in Twisted 22.2.0.
Workarounds
Limit access to the SSH server only to trusted source IP addresses. Connect over SSH only to trusted destination IP addresses.
References
Reported at https://twistedmatrix.com/trac/ticket/10284 Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
For more information
Found by vin01
Other sources
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as nc -rv localhost 22 < /dev/zero. A patch is available in version 22.2.0. There are currently no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-21716?
CVE-2022-21716 is a vulnerability in the Twisted SSH client and server implementation that allows a malicious peer to crash the server and cause a denial of service by sending an infinite amount of data.
What is the impact of CVE-2022-21716?
The impact of CVE-2022-21716 is a denial of service, as the server can be crashed by a malicious peer.
How can a malicious peer exploit CVE-2022-21716?
A malicious peer can exploit CVE-2022-21716 by crafting a request that uses all available memory, causing the server to crash.
Which versions of Twisted are affected by CVE-2022-21716?
Versions of Twisted between 21.7.0 and 22.2.0 are affected by CVE-2022-21716.
How can I remediate the CVE-2022-21716 vulnerability?
To remediate the CVE-2022-21716 vulnerability, update Twisted to version 22.2.0 or later.