[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Feb 2023 22:38:23 +0000
From: Qualys Security Advisory <qsa@...lys.com>
To: Georgi Guninski <gguninski@...il.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: double-free vulnerability in OpenSSH server 9.1
Hi Georgi, all,
On Thu, Feb 02, 2023 at 09:06:19PM +0200, Georgi Guninski wrote:
> Nice find :)
> This is very complicated codepath, did a human found it "manually"
> or some analysis program found it?
Good question! Technically, we did not find the double free: we found
the underlying bug in compat_kex_proposal() (the "unintended" free of
options.kex_algorithms) during a manual code review, and reported it to
the OpenSSH developers in July 2022.
Unfortunately, back then we (Qualys) mistakenly believed that "this does
not seem to lead to a use-after-free or double-free, but the dangling
pointer in options.kex_algorithms is probably not ideal."
Then, in January 2023, Mantas Mikulenas reported a double free in sshd
to the OpenSSH bugzilla, and we immediately realized that this was a
direct consequence of the bug in compat_kex_proposal().
Thank you very much for your mail! With best regards,
--
the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
