Bugzilla – Bug 1213198
VUL-0: CVE-2023-3603: libssh: Processing SFTP server read may cause NULL dereference
Last modified: 2023-11-24 14:52:04 UTC
CVE-2023-3603 There is no upstream security advisory yet. It should be published under: https://www.libssh.org/security/advisories/CVE-2023-3603.txt Current RH bug report: ---------------------- Given this code is not in any released versions, no security release has been issued. Missing allocation check in sftp server processing read requests may cause NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which is being unchecked for failure. This will likely crash the authenticated user sftp server's connection (if implemented as forking as we recommend). For thread-based servers, this might cause DoS also for legitimate users. ---------------------- References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3603 https://bugzilla.redhat.com/show_bug.cgi?id=2221791
commit fe80f47b0ae8902d229ef9b8a1b4fa949b92e720 Author: Jakub Jelen <jjelen@redhat.com> Date: Tue Jun 27 14:56:14 2023 +0200 sftpserver: Add missing allocation check that might cause NULL dereference Originally reported by Wei Chong Tan <shellcurity at protonmail.com> Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Norbert Pocs <npocs@redhat.com> diff --git a/src/sftpserver.c b/src/sftpserver.c index 8f15f39e..7d8070b1 100644 --- a/src/sftpserver.c +++ b/src/sftpserver.c @@ -962,6 +962,12 @@ process_read(sftp_client_message client_msg) } buffer = malloc(client_msg->len); + if (buffer == NULL) { + ssh_set_error_oom(sftp->session); + sftp_reply_status(client_msg, SSH_FX_FAILURE, NULL); + SSH_LOG(SSH_LOG_PROTOCOL, "Failed to allocate memory for read data"); + return SSH_ERROR; + } do { ssize_t readn = read(fd, buffer + allreadn, client_msg->len - allreadn); if (readn < 0) {
the problematic code is only in an unreleased libssh version, older versions are not affected.