Date: Wed, 22 Feb 2023 10:17:19 -0500 From: Demi Marie Obenour <demi@...isiblethingslab.com> To: oss-security@...ts.openwall.com Subject: Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136) On Wed, Feb 22, 2023 at 05:54:36AM +0000, Qualys Security Advisory wrote: > Hi all, > > Another quick update on the exploitation of this double-free bug on > OpenBSD: > > a/ our previous attack (the arbitrary control of sshd's instruction > pointer via the EVP_AES_KEY structure) works only on OpenBSD amd64, not > on OpenBSD i386; > > b/ we were able to recycle the chunk of memory where > options.kex_algorithms was allocated, into a chunk of a different size > (which gives us greater freedom), but this happens with such a low > probability (even on i386) that we do not consider this particular > attack to be practical; > > c/ as a direct consequence of CVE-2023-25136, we found an information > leak (of bits and pieces from the memory of the unprivileged sshd > process), but it is unlikely to be useful in practice. Is it possible to use this information leak to bypass ASLR without crashing the process? If so, then one could use the control of the instruction pointer to jump to a ROP chain and get code execution. This flaw would then be at least the third RCE in OpenBSD’s default install, and the second in OpenSSH. Also, is this flaw expected to be exploitable for code execution on GNU/Linux? -- Sincerely, Demi Marie Obenour (she/her/hers) Invisible Things Lab Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.