RSA Public Key Parsing Denial of Service via Large Modulus

Executive Summary

The vulnerability involves the RSA and DSA public key parsers in Go, which did not enforce size limits on key parameters.

An attacker can craft a public key with an excessively large modulus or DSA parameter, causing the signature verification process to consume several minutes of CPU time.

This excessive CPU consumption can be triggered by unauthenticated clients during public key authentication.

To mitigate this, RSA moduli are now limited to 8192 bits, and DSA parameters are validated according to FIPS 186-2 standards.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a denial-of-service (DoS) condition by causing excessive CPU consumption during signature verification.

Unauthenticated clients can exploit this by sending crafted public keys with large parameters, which can slow down or disrupt services relying on public key authentication.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that you are using the latest version of the golang.org/x/crypto package, specifically version v0.52.0 or later, where the issue has been fixed.

The fix enforces size limits on RSA moduli (limited to 8192 bits) and validates DSA parameters according to FIPS 186-2 standards, preventing crafted public keys with excessively large parameters from causing excessive CPU consumption.

Updating your Go environment and any dependent packages that use the affected SSH functions (such as Dial, NewClientConn, ParseAuthorizedKey) will help prevent denial-of-service attacks triggered by unauthenticated clients during public key authentication.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves crafted RSA or DSA public keys with excessively large parameters causing high CPU consumption during signature verification. Detection would involve monitoring for unusually high CPU usage during public key authentication attempts, especially from unauthenticated clients.

Since the vulnerability is triggered by public key authentication using malformed keys, one approach is to analyze SSH authentication logs for repeated or suspicious public key authentication attempts that coincide with CPU spikes.

Specific commands to detect this vulnerability are not provided in the available resources.

Useful 0 Not Useful 0