REDHAT-BUG-2553037: Medium severity OpenSSH OpenSSH vulnerability
A flaw was found in OpenSSH. uncompressbuffer could keep growing the output buffer inside the inflate loop until it passed the maximum packet size. The fix returns SSHERRINVALIDFORMAT once the buffer reaches PACKETMAXSIZE. This applies only after compression has been negotiated. The extra memory stays in that connection's process. This is not a demonstrated memory-corruption flaw, and it is a different bug and reporter from the LZ77 dictionary leak.
Affected Software
Event History
Frequently Asked Questions
When is an OpenSSH server or client exposed to this issue?
The issue applies only to connections where SSH compression has been negotiated. The retained memory is associated with the process handling that connection.
What does an attacker need to do to trigger the condition?
An attacker would need to interact over an SSH connection with compression negotiated and cause decompression output to grow during the inflate loop. The provided information does not identify any additional authentication or access prerequisite.
Is this a memory-corruption vulnerability?
No demonstrated memory-corruption impact is described. The flaw concerns output-buffer growth beyond the maximum packet-size limit and retained memory within the connection's process.
What behavior does the fix introduce?
The fix stops processing and returns SSH_ERR_INVALID_FORMAT once the decompression buffer reaches PACKET_MAX_SIZE, rather than allowing it to continue growing.