Executive Summary

This vulnerability exists in the Russh Rust SSH client and server library versions from 0.34.0 up to but not including 0.61.1. When SSH compression is enabled, the library accepted compressed packets that passed normal size checks on the wire but expanded to a much larger size after decompression. This allowed a remote attacker to send packets that were oversized after decompression, which should have been rejected.

The issue leads to a remote denial-of-service (DoS) or resource exhaustion because the system processes these large decompressed packets, consuming excessive resources. The problem was worse in versions before 0.58.0 due to the use of CryptoVec in the decompression path. The vulnerability was fixed in version 0.61.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a remote attacker to cause a denial-of-service condition on your system using the Russh SSH library. By sending specially crafted compressed packets that decompress to very large sizes, the attacker can exhaust system resources such as memory or CPU, potentially causing the SSH service or the host to become unresponsive or crash.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the russh library to version 0.61.1 or later, where the issue has been patched.

Additionally, consider disabling SSH compression if it is enabled, as the vulnerability occurs when SSH compression is active.

Useful 0 Not Useful 0