Bug 1213198 (CVE-2023-3603)

Summary: VUL-0: CVE-2023-3603: libssh: Processing SFTP server read may cause NULL dereference
Product: [Novell Products] SUSE Security Incidents Reporter: Alexander Bergmann <abergmann>
Component: IncidentsAssignee: James McDonough <jmcdonough>
Status: RESOLVED UPSTREAM QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: anicka, cathy.hu, meissner, security-team, stoyan.manolov
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/371772/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3603:3.1:(AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Alexander Bergmann 2023-07-11 07:28:01 UTC 
CVE-2023-3603

There is no upstream security advisory yet.

It should be published under:
https://www.libssh.org/security/advisories/CVE-2023-3603.txt

Current RH bug report:
----------------------
Given this code is not in any released versions, no security release  has
been issued.

Missing allocation check in sftp server processing read requests may
cause NULL dereference on low-memory conditions. The malicious client
can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers,
which is being unchecked for failure.

This will likely crash the authenticated user sftp server's connection
(if implemented as forking as we recommend). For thread-based
servers, this might cause DoS also for legitimate users.
----------------------

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3603
https://bugzilla.redhat.com/show_bug.cgi?id=2221791
Comment 4 Marcus Meissner 2023-11-24 14:49:03 UTC 
commit fe80f47b0ae8902d229ef9b8a1b4fa949b92e720
Author: Jakub Jelen <jjelen@redhat.com>
Date:   Tue Jun 27 14:56:14 2023 +0200

    sftpserver: Add missing allocation check that might cause NULL dereference
    
    Originally reported by Wei Chong Tan <shellcurity at protonmail.com>
    
    Signed-off-by: Jakub Jelen <jjelen@redhat.com>
    Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
    Reviewed-by: Norbert Pocs <npocs@redhat.com>

diff --git a/src/sftpserver.c b/src/sftpserver.c
index 8f15f39e..7d8070b1 100644
--- a/src/sftpserver.c
+++ b/src/sftpserver.c
@@ -962,6 +962,12 @@ process_read(sftp_client_message client_msg)
     }
 
     buffer = malloc(client_msg->len);
+    if (buffer == NULL) {
+        ssh_set_error_oom(sftp->session);
+        sftp_reply_status(client_msg, SSH_FX_FAILURE, NULL);
+        SSH_LOG(SSH_LOG_PROTOCOL, "Failed to allocate memory for read data");
+        return SSH_ERROR;
+    }
     do {
         ssize_t readn = read(fd, buffer + allreadn, client_msg->len - allreadn);
         if (readn < 0) {
Comment 6 Marcus Meissner 2023-11-24 14:52:04 UTC 
the problematic code is only in an unreleased libssh version, older versions are not affected.