Verified Commit 687ef1c4 authored by Pavol Žáčik's avatar Pavol Žáčik
Browse files

CVE-2026-59843 channels: Fail when receiving max packet size 0 

Do this both for SSH2_MSG_CHANNEL_OPEN and for
SSH2_MSG_CHANNEL_OPEN_CONFIRMATION. Using the
max packet size 0 would lead to an infinite loop
in channel_write_common.

Originally reported by Rinku Das on on 23th February.
Independently reported by Yi Lin on 26th February and
Haruto Kimura on 22nd March.

We do not consider this as a security issue as connecting
to untrusted servers on the internet brings much worse
security consequences than hanging your clinet.

Signed-off-by: default avatarPavol Žáčik <pzacik@redhat.com>
Reviewed-by: default avatarJakub Jelen <jjelen@redhat.com>
(cherry picked from commit 44b186fa)
parent 64a97e44

src/channels.c

+7 −0
Original line number Diff line number Diff line
@@ -195,6 +195,13 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){ 
  if (rc != SSH_OK)

      goto error;



  if (channel->remote_maxpacket == 0) {

      SSH_LOG(SSH_LOG_RARE,

              "Invalid maximum packet size 0 in "

              "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION");

      goto error;

  }



  SSH_LOG(SSH_LOG_DEBUG,

      "Received a CHANNEL_OPEN_CONFIRMATION for channel %" PRIu32 ":%" PRIu32,

      channel->local_channel,

src/messages.c

+15 −4
Original line number Diff line number Diff line
@@ -1203,10 +1203,21 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open){ 
  SSH_LOG(SSH_LOG_PACKET,

      "Clients wants to open a %s channel", type_c);



  ssh_buffer_unpack(packet,"ddd",

  rc = ssh_buffer_unpack(packet,

                         "ddd",

                         &msg->channel_request_open.sender,

                         &msg->channel_request_open.window,

                         &msg->channel_request_open.packet_size);

  if (rc != SSH_OK){

      goto error;

  }



  if (msg->channel_request_open.packet_size == 0) {

      ssh_set_error(session,

                    SSH_FATAL,

                    "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN");

      goto error;

  }



  if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED){

    ssh_set_error(session,SSH_FATAL, "Invalid state when receiving channel open request (must be authenticated)");