GHSA-4p9f-7p9m-5vfg: russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, the client Session::processpacket path in russh/src/client/encrypted.rs accepts repeated packets encoded with russh's private msg::EXTINFO = 7 before authentication, while the standards-compliant EXTINFO message number 82 does not reach the affected handler. The handleextinfo function appends every parsed extension name to receivedextensions without clearing, deduplicating, or bounding the vector. A malicious SSH server that deliberately sends private message number 7 can therefore retain an unbounded number of attacker-controlled extension names for the session lifetime, causing progressive client memory exhaustion. This issue is fixed in version 0.65.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using russh as an SSH client are exposed when they connect to a malicious SSH server. The affected processing occurs before authentication, so the server does not need valid client credentials or a completed SSH login.
What does an attacker need to do to trigger the memory exhaustion?
A malicious SSH server must repeatedly send packets using russh's private EXT_INFO message number 7. Standard EXT_INFO packets using message number 82 do not reach the affected handler.
Are affected clients vulnerable during a normal connection setup?
Yes. The affected packet path is reached before authentication, and repeated attacker-controlled extension names are retained for the lifetime of the session, progressively consuming client memory.
What version fixes the issue?
The issue is fixed in russh version 0.65.0. Versions prior to 0.65.0 are affected.