CVE-2023-3603: Processing sftp server read may cause null dereference
A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user's sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users. Given this code is not in any released versions, no security releases have been issued.
Other sources
Given this code is not in any released versions, no security release has been issued.
Missing allocation check in sftp server processing read requests may cause NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which is being unchecked for failure.
This will likely crash the authenticated user sftp server's connection (if implemented as forking as we recommend). For thread-based servers, this might cause DoS also for legitimate users.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-3603?
CVE-2023-3603 is a vulnerability in the Libssh library that allows a malicious client to cause a NULL dereference on low-memory conditions.
What is the severity of CVE-2023-3603?
CVE-2023-3603 has a severity rating of medium with a CVSS score of 6.5.
How does CVE-2023-3603 exploit work?
CVE-2023-3603 can be exploited by a malicious client requesting up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which can lead to a NULL dereference and potentially crash the server.
How can I fix CVE-2023-3603?
To fix CVE-2023-3603, it is recommended to update to the latest version of the Libssh library that includes the patch for this vulnerability.
Where can I find more information about CVE-2023-3603?
You can find more information about CVE-2023-3603 on the Red Hat Bugzilla page (https://bugzilla.redhat.com/show_bug.cgi?id=2221791) and the Red Hat Security Advisory (https://access.redhat.com/security/cve/CVE-2023-3603).