PkgSeer

Vulnerability RUSTSEC-2024-0450

High Risk

2 years ago

Memory exhaustion from an unchecked SSH packet length

>=0.0.0-0 <0.44.1

Summary

Memory exhaustion from an unchecked SSH packet length

Details

When reading a packet, russh took the 4-byte packet length sent by the peer and sized its receive buffer from it without any upper bound. The length is fully controlled by the other side of the connection and is read before authentication, so an unauthenticated client can claim packets of up to about 4 GiB and make a server allocate that much memory per connection. A few such connections are enough to run the process out of memory.

From 0.44.1, lengths above 256 KiB are rejected with Error::PacketSize before the buffer is sized.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

<0.65.0 GHSA-vp5q-ff62-jwqv

russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)

>=0.60.0 <0.65.0 GHSA-fw5c-8223-6h42

russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

<0.65.0 GHSA-9wfm-jcj8-jfv9

russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

<0.65.0 GHSA-4p9f-7p9m-5vfg

Agent server signs with confirm-constrained keys without calling `Agent::confirm`

>=0.50.0-beta.12 <0.65.0 RUSTSEC-2026-0495

View all vulnerabilities for these packages

Impacted packages

russh

Timeline

Published

2 years ago

Fixed (0.44.1)

2 years ago

Last Modified

1 hour ago