Fix CVE-2026-3497#244
Conversation
Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Based on https://src.fedoraproject.org/rpms/openssh/c/f595270c4ac496ad743336e80a4f3cc11a144efb?branch=rawhide by Zoltan Fridrich <zfridric@redhat.com>
|
Untested so far. Also still unclear if the GSI functionality is affected. |
| if (kex->dh == NULL) { | ||
| sshpkt_disconnect(ssh, "Protocol error: no matching group found"); | ||
| fatal("Protocol error: no matching group found"); | ||
| ssh_packet_disconnect(ssh, "Protocol error: no matching group found"); |
There was a problem hiding this comment.
@msalle : Here I wonder if that is enough, as the original code did end - I guess the key exchange - with fatal() at this point. But the change by Red Hat has it that way.
There was a problem hiding this comment.
I'd stick to what RH is doing, although it might look a bit odd.
However from https://github.com/openssh/openssh-portable/blob/master/packet.c#L2121 and further it is clear that ssh_packet_disconnect() never returns and so there should indeed be no a reason for a subsequent fatal().
msalle
left a comment
msalle
left a comment
There was a problem hiding this comment.
I haven't tested it, but I'd say if it builds ok and you have tested also run-time that it works, and given that it's mostly (if not all) the fixes from RH in any case, I'd say it looks fine to me.
| if (kex->dh == NULL) { | ||
| sshpkt_disconnect(ssh, "Protocol error: no matching group found"); | ||
| fatal("Protocol error: no matching group found"); | ||
| ssh_packet_disconnect(ssh, "Protocol error: no matching group found"); |
There was a problem hiding this comment.
I'd stick to what RH is doing, although it might look a bit odd.
However from https://github.com/openssh/openssh-portable/blob/master/packet.c#L2121 and further it is clear that ssh_packet_disconnect() never returns and so there should indeed be no a reason for a subsequent fatal().
2 participants
Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex
Based on https://src.fedoraproject.org/rpms/openssh/c/f595270c4ac496ad743336e80a4f3cc11a144efb?branch=rawhide by Zoltan Fridrich zfridric@redhat.com