Home
|
FAQ
|
Feedback
|
Licence
|
Updates
|
Mirrors
|
Keys
|
Links
|
Team
Download:
Stable
·
Snapshot
|
Docs
|
Privacy
|
Changes
|
Wishlist
PuTTY's implementation of the little-used RSA kex exchange method
(RFC 4432) has a double-free bug: in some situations it frees
an RSA key by calling the special-purpose
function ssh_rsakex_freekey and then also
calling the normal free function on the outermost struct, which is
wrong, because ssh_rsakex_freekey already freed the whole
struct.
This bug does not happen if RSA kex completes normally. The double-free only occurs on an error handling path, triggered if the key sent by the server is unexpectedly short.
This bug allows a server to provoke the double-free on purpose, because it can present only RSA kex as an option in its KEXINIT, and then deliberately send a short key. Since it happens before host key verification, a MITM can do the same. Therefore, this bug is listed as a vulnerability, since it's a remote-triggerable crash. However, we don't know of any way in which the double-free can be exploited to achieve a controllable effect.
Thanks to Ben Smyth for the report.
Apparently this was introduced during work in 2019 to make a test SSH server out of the PuTTY code (including an option to pass in a fixed key pair for RSA kex, complicating the question of whether to free it after use). Confusion was increased by the historical oddity that PuTTY's RSA keys were originally held in a struct that was not freed along with its contents.