A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Se ha descubierto un fallo en el paquete OpenSSH. Por cada paquete ping que recibe el servidor SSH, se asigna un paquete pong en un búfer de memoria y se almacena en una cola de paquetes. Solo se libera cuando finaliza el intercambio de claves entre el servidor y el cliente. Un cliente malintencionado puede seguir enviando dichos paquetes, lo que provoca un aumento descontrolado del consumo de memoria en el lado del servidor. En consecuencia, el servidor puede dejar de estar disponible, lo que da lugar a un ataque de denegación de servicio.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-770
|
| [email protected] | Secondary |
en
CWE-770
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openbsd | openssh | 9.5 | <built-in method update of dict object at 0x7fd340891240> | Application |
| openbsd | openssh | 9.6 | <built-in method update of dict object at 0x7fd36b3bd600> | Application |
| openbsd | openssh | 9.6 | <built-in method update of dict object at 0x7fd384a21840> | Application |
| openbsd | openssh | 9.7 | <built-in method update of dict object at 0x7fd3847a6fc0> | Application |
| openbsd | openssh | 9.7 | <built-in method update of dict object at 0x7fd340891640> | Application |
| openbsd | openssh | 9.8 | <built-in method update of dict object at 0x7fd36b3be600> | Application |
| openbsd | openssh | 9.8 | <built-in method update of dict object at 0x7fd39c4b0d40> | Application |
| openbsd | openssh | 9.9 | <built-in method update of dict object at 0x7fd36be62740> | Application |
| openbsd | openssh | 9.9 | <built-in method update of dict object at 0x7fd340890e40> | Application |
| canonical | ubuntu_linux | 24.04 | <built-in method update of dict object at 0x7fd34927c1c0> | Operating System |
| canonical | ubuntu_linux | 24.10 | <built-in method update of dict object at 0x7fd2d81488c0> | Operating System |
| debian | debian_linux | 11.0 | <built-in method update of dict object at 0x7fd319ebbac0> | Operating System |
| debian | debian_linux | 12.0 | <built-in method update of dict object at 0x7fd2905c3380> | Operating System |
| debian | debian_linux | 13.0 | <built-in method update of dict object at 0x7fd319ebbe00> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:* |