Russh is a Rust SSH client & server library. Prior to 0.62.4, an unauthenticated SSH client can cause a denial of service by sending SSHMSGKEXECDHINIT with a 32-byte all-zero QC value. Curve25519Kex::serverdh in russh/src/kex/curve25519.rs accepts the all-zero peer public value and computes an all-zero shared secret, after which computeexchangehash calls encodempint in russh/src/kex/mod.rs and indexes beyond the end of the input while skipping leading zero bytes. The resulting panic occurs before authentication and terminates the server key-exchange task. This issue is fixed in version 0.62.4.

Russh is a Rust SSH client & server library. Prior to 0.62.4, a malicious SSH server can crash a russh client session with a malformed KEXECDHREPLY containing a server ephemeral value that is not 32 bytes long. The client-side Curve25519Kex::computesharedsecret function in russh/src/kex/curve25519.rs passes the decoded exchange.serverephemeral value to clonefromslice without validating its length, causing a deterministic panic before the server host key is verified. The panic terminates the spawned client session task and surfaces as a JoinError, while the embedding process normally remains running. This issue is fixed in version 0.62.4.

On 12/18/23 08:08, Fabian Bäumer wrote: Mitigations

Open source projects I see have implemented this already are:

- AsyncSSH 2.14.2: https://asyncssh.readthedocs.io/en/latest/changes.html#release-2-14-2-18-dec-2023

- Dropbear git: https://github.com/mkj/dropbear/commit/6e43be5c7b99dbee49dc72b6f989f29fdd7e9356

- Erlang ssh 5.1.1: https://www.erlang.org/doc/apps/ssh/notes

- golang.org/x/crypto 0.17.0: https://groups.google.com/g/golang-announce/c/qA3XtxvMUyg

- libssh 0.10.6 and 0.9.8: https://www.libssh.org/2023/12/18/libssh-0-10-6-and-libssh-0-9-8-security-releases/

- libssh2 git: https://github.com/libssh2/libssh2/issues/1290 https://github.com/libssh2/libssh2/pull/1291

- OpenSSH 9.6: https://www.openssh.com/txt/release-9.6

- Paramiko 3.4.0: https://www.paramiko.org/changelog.html#3.4.0

- PuTTY 0.80: https://lists.tartarus.org/pipermail/putty-announce/2023/000037.html

- russh 0.40.2: https://github.com/warp-tech/russh/releases/tag/v0.40.2

- SFTPGo 2.5.6: https://github.com/drakkan/sftpgo/releases/tag/v2.5.6

- ssh2 [node.js/npm] 1.15.0: https://github.com/mscdex/ssh2/commits/v1.15.0

- Tera Term 5.1: https://github.com/TeraTermProject/teraterm/releases/tag/v5.1

- Thrussh 0.35.1: https://pijul.org/posts/2023-12-18-thrussh-cve/

There's also some open bugs against these open source projects that are not yet handled:

- Apache Mina: https://github.com/apache/mina-sshd/issues/445

- ProFTPD (modsftp): https://github.com/proftpd/proftpd/issues/1760

- SSHJ: https://github.com/hierynomus/sshj/issues/916

-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris