GHSA-fw5c-8223-6h42: russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximumpacketsize of zero and passes it into ChannelTx::pollwritable in russh/src/channels/io/tx.rs. The Channel::data, Channel::makewriter, and Channel::intostream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
russhto a version that resolves this vulnerability.Fixed in 0.65.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using russh versions from 0.60.0 up to, but not including, 0.65.0 are affected. Both russh SSH client and server use cases can be exposed through channel-open handling.
What access does an attacker need to trigger the hang?
A server deployment can be affected by an authenticated client that declares a zero maximum packet size when opening a channel. A client deployment can be affected by a malicious SSH server.
What is the operational impact of successful exploitation?
Affected asynchronous channel write paths can remain pending indefinitely without returning an error. Tasks, channels, and connections may accumulate, resulting in resource exhaustion and reduced availability.
What should teams do to remediate the issue?
Upgrade russh to version 0.65.0, which fixes the issue.