Heap Out-of-Bounds Read in OpenSSH GSSAPI Cleanup

Executive Summary

This vulnerability is a heap out-of-bounds read in OpenSSH related to the cleanup of GSSAPI indicators. It happens because the auth-indicators array lacks a proper trailing NULL termination, causing the program to read beyond the allocated memory during cleanup.

Specifically, when the array is resized, the new pointer slot is not set to NULL, so functions that rely on a NULL sentinel to know the end of the array may read invalid memory. This flaw can be triggered in environments using GSSAPI authentication with Kerberos tickets that include authenticated auth-indicators.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker could exploit this vulnerability to cause the SSH authentication process to crash or abort, resulting in a denial of service (DoS). This impacts the availability of the SSH service, potentially preventing legitimate users from authenticating.

There is no established impact on confidentiality or integrity, and the overall severity is considered low due to the narrow conditions required for exploitation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs in OpenSSH when built with GSSAPI support and deployed with GSSAPIAuthentication enabled. Detection involves verifying if your OpenSSH version is affected and if GSSAPIAuthentication is enabled.

• Check the OpenSSH version to see if it matches the affected version (e.g., openssh-10.2p1-10.1.hum1 or similar builds with GSSAPI support).
• Verify if GSSAPIAuthentication is enabled in your SSH server configuration by running: `grep -i GSSAPIAuthentication /etc/ssh/sshd_config`
• Check if your environment uses Kerberos tickets with authenticated auth-indicators, which are required for exploitation.

There are no specific commands provided to detect exploitation attempts or crashes caused by this vulnerability, but monitoring SSH service logs for authentication crashes or abnormal terminations related to GSSAPI may help identify issues.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps focus on disabling or restricting the vulnerable features until a patch is applied.

• Disable GSSAPIAuthentication in your SSH server configuration by setting `GSSAPIAuthentication no` in `/etc/ssh/sshd_config` and restarting the SSH service.
• Avoid using GSSAPIIndicators in your authentication setup.
• Restrict or avoid Kerberos tickets that carry authenticated auth-indicators values.

Applying the vendor-provided patch or updating OpenSSH to a fixed version when available is recommended for a permanent fix.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service (DoS) by crashing the SSH authentication path under specific configurations, impacting availability.

There is no established impact on confidentiality or integrity, which are critical factors for compliance with standards like GDPR or HIPAA.

Since the vulnerability affects availability only and does not compromise data confidentiality or integrity, its direct effect on compliance with regulations such as GDPR or HIPAA is limited.

Useful 0 Not Useful 0