libssh Remote DoS via Zero Max Packet Size Advertisement

Executive Summary

This is a denial of service vulnerability in libssh where a remote authenticated peer can send a zero maximum packet size in SSH channel open messages. This causes the system to enter an infinite loop during channel writes, consuming CPU resources and making the service unresponsive.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unusual CPU usage spikes on systems using libssh. Check SSH server logs for malformed channel open messages with zero maximum packet sizes. Use network traffic analysis tools to inspect SSH_MSG_CHANNEL_OPEN and SSH_MSG_CHANNEL_OPEN_CONFIRMATION messages for invalid packet size values.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause high CPU usage and system slowdowns, potentially leading to service outages. It requires an attacker to be authenticated, but once exploited, it disrupts normal operations by freezing SSH channel handling.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service by consuming CPU resources indefinitely, which could disrupt critical services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, potentially violating Article 32 requirements for security and resilience. For HIPAA, it could disrupt systems handling protected health information, affecting integrity and availability requirements under the Security Rule.

Useful 0 Not Useful 0

Mitigation Strategies

Update libssh to the latest patched version immediately. If an update is not available, restrict SSH access to trusted networks or users. Monitor affected systems for abnormal CPU usage and terminate suspicious SSH sessions.

Useful 0 Not Useful 0