a97adc51f9
Resolves: RHEL-215674 Resolves: RHEL-215675 Resolves: RHEL-215676 Resolves: RHEL-215677 Resolves: RHEL-215678 Resolves: RHEL-215679 Resolves: RHEL-215680 Assisted-by: Ymir
77 lines
2.7 KiB
Diff
77 lines
2.7 KiB
Diff
From 68bcbcc1d78c5109417c367bdfaf00142f5d8847 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
|
|
Date: Fri, 6 Mar 2026 13:58:30 +0100
|
|
Subject: [PATCH] channels: Fail when receiving max packet size 0
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Do this both for SSH2_MSG_CHANNEL_OPEN and for
|
|
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION. Using the
|
|
max packet size 0 would lead to an infinite loop
|
|
in channel_write_common.
|
|
|
|
Originally reported by Rinku Das on on 23th February.
|
|
Independently reported by Yi Lin on 26th February and
|
|
Haruto Kimura on 22nd March.
|
|
|
|
We do not consider this as a security issue as connecting
|
|
to untrusted servers on the internet brings much worse
|
|
security consequences than hanging your clinet.
|
|
|
|
Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
|
|
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
|
|
---
|
|
src/channels.c | 7 +++++++
|
|
src/messages.c | 19 +++++++++++++++----
|
|
2 files changed, 22 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/src/channels.c b/src/channels.c
|
|
index 36e1959..df84b90 100644
|
|
--- a/src/channels.c
|
|
+++ b/src/channels.c
|
|
@@ -187,6 +187,13 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){
|
|
if (rc != SSH_OK)
|
|
goto error;
|
|
|
|
+ if (channel->remote_maxpacket == 0) {
|
|
+ SSH_LOG(SSH_LOG_RARE,
|
|
+ "Invalid maximum packet size 0 in "
|
|
+ "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION");
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
SSH_LOG(SSH_LOG_DEBUG,
|
|
"Received a CHANNEL_OPEN_CONFIRMATION for channel %d:%d",
|
|
channel->local_channel,
|
|
diff --git a/src/messages.c b/src/messages.c
|
|
index 2f4f99f..8c37b59 100644
|
|
--- a/src/messages.c
|
|
+++ b/src/messages.c
|
|
@@ -1154,10 +1154,21 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open){
|
|
SSH_LOG(SSH_LOG_PACKET,
|
|
"Clients wants to open a %s channel", type_c);
|
|
|
|
- ssh_buffer_unpack(packet,"ddd",
|
|
- &msg->channel_request_open.sender,
|
|
- &msg->channel_request_open.window,
|
|
- &msg->channel_request_open.packet_size);
|
|
+ rc = ssh_buffer_unpack(packet,
|
|
+ "ddd",
|
|
+ &msg->channel_request_open.sender,
|
|
+ &msg->channel_request_open.window,
|
|
+ &msg->channel_request_open.packet_size);
|
|
+ if (rc != SSH_OK){
|
|
+ goto error;
|
|
+ }
|
|
+
|
|
+ if (msg->channel_request_open.packet_size == 0) {
|
|
+ ssh_set_error(session,
|
|
+ SSH_FATAL,
|
|
+ "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN");
|
|
+ goto error;
|
|
+ }
|
|
|
|
if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED){
|
|
ssh_set_error(session,SSH_FATAL, "Invalid state when receiving channel open request (must be authenticated)");
|