Bug 1213198 (CVE-2023-3603) - VUL-0: CVE-2023-3603: libssh: Processing SFTP server read may cause NULL dereference
Summary: VUL-0: CVE-2023-3603: libssh: Processing SFTP server read may cause NULL dere...
Status: RESOLVED UPSTREAM
Alias: CVE-2023-3603
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: James McDonough
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/371772/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-3603:3.1:(AV:N...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-11 07:28 UTC by Alexander Bergmann
Modified: 2023-11-24 14:52 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2023-07-11 07:28:01 UTC
CVE-2023-3603

There is no upstream security advisory yet.

It should be published under:
https://www.libssh.org/security/advisories/CVE-2023-3603.txt

Current RH bug report:
----------------------
Given this code is not in any released versions, no security release  has
been issued.

Missing allocation check in sftp server processing read requests may
cause NULL dereference on low-memory conditions. The malicious client
can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers,
which is being unchecked for failure.

This will likely crash the authenticated user sftp server's connection
(if implemented as forking as we recommend). For thread-based
servers, this might cause DoS also for legitimate users.
----------------------

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3603
https://bugzilla.redhat.com/show_bug.cgi?id=2221791
Comment 4 Marcus Meissner 2023-11-24 14:49:03 UTC
commit fe80f47b0ae8902d229ef9b8a1b4fa949b92e720
Author: Jakub Jelen <jjelen@redhat.com>
Date:   Tue Jun 27 14:56:14 2023 +0200

    sftpserver: Add missing allocation check that might cause NULL dereference
    
    Originally reported by Wei Chong Tan <shellcurity at protonmail.com>
    
    Signed-off-by: Jakub Jelen <jjelen@redhat.com>
    Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
    Reviewed-by: Norbert Pocs <npocs@redhat.com>

diff --git a/src/sftpserver.c b/src/sftpserver.c
index 8f15f39e..7d8070b1 100644
--- a/src/sftpserver.c
+++ b/src/sftpserver.c
@@ -962,6 +962,12 @@ process_read(sftp_client_message client_msg)
     }
 
     buffer = malloc(client_msg->len);
+    if (buffer == NULL) {
+        ssh_set_error_oom(sftp->session);
+        sftp_reply_status(client_msg, SSH_FX_FAILURE, NULL);
+        SSH_LOG(SSH_LOG_PROTOCOL, "Failed to allocate memory for read data");
+        return SSH_ERROR;
+    }
     do {
         ssize_t readn = read(fd, buffer + allreadn, client_msg->len - allreadn);
         if (readn < 0) {
Comment 6 Marcus Meissner 2023-11-24 14:52:04 UTC
the problematic code is only in an unreleased libssh version, older versions are not affected.