![]() |
|
Message-ID: <20230202223830.GA1002@localhost.localdomain> Date: Thu, 2 Feb 2023 22:38:23 +0000 From: Qualys Security Advisory <qsa@...lys.com> To: Georgi Guninski <gguninski@...il.com> CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: Re: double-free vulnerability in OpenSSH server 9.1 Hi Georgi, all, On Thu, Feb 02, 2023 at 09:06:19PM +0200, Georgi Guninski wrote: > Nice find :) > This is very complicated codepath, did a human found it "manually" > or some analysis program found it? Good question! Technically, we did not find the double free: we found the underlying bug in compat_kex_proposal() (the "unintended" free of options.kex_algorithms) during a manual code review, and reported it to the OpenSSH developers in July 2022. Unfortunately, back then we (Qualys) mistakenly believed that "this does not seem to lead to a use-after-free or double-free, but the dangling pointer in options.kex_algorithms is probably not ideal." Then, in January 2023, Mantas Mikulenas reported a double free in sshd to the OpenSSH bugzilla, and we immediately realized that this was a direct consequence of the bug in compat_kex_proposal(). Thank you very much for your mail! With best regards, -- the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.