-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Exploit not working in 6.6.p1 #1
Comments
It's been so long, I barely even remembered I'd written this. I just tested it against FreeBSD 9.3-STABLE and confirmed that it has no effect. Here's a clue as to why:
After the first
That function is in
These handlers are initialized by
If you look at
Unsurprisingly, if However, this code was significantly rewritten between 6.7 and 6.8. Instead of having the KEX code actively request and validate the next packet, it simply sets a handler for the packet it expects (
If the correct packet is received, the correct handler is called, but the server loop now also accepts and dispatches other types of packets. This is what kexkill takes advantage of. The bug was fixed between 7.3 and 7.4 by having
The server loop no longer knows what to do with it and throws a fatal error instead. To summarize: the bug is real and kexkill works (which I verified by taking a 10.4-STABLE VM and rolling back OpenSSH to an unpatched 7.2p1), but only OpenSSH 6.8 through 7.3 are vulnerable. The precise impact of the bug varies, but in theory, especially on a small system, it can trigger the OOM killer and completely kill sshd or other services. Note that I also found and fixed a bug while working on this, so be sure to grab the latest version. |
Update: I notified NIST, and they have updated the NVD entry to reflect this information. |
Hi! Thanks for the detailed explanation! I tried the same with version OpenSSH-6.8p1 with the latest version of kexkill but still no luck, but it may be some mis-configuration. If I get some free time (actually, a lot as it is not trivial to me) to delve into this CVE, I'll ping you back. Thanks for your time! =) |
Did you build it yourself or did you use your OS vendor's package? If the latter, it's quite likely patched. Either try to revert it to an unpatched version or just build it yourself from source. |
i can not exploited this vulnerability with success too |
Please open a new issue with detailed information about your problem. |
Hello,
I was researching about vulnerabilities to protect our production environment and found the CVE https://www.cvedetails.com/cve/CVE-2016-8858/
I setuped a VM with ubuntu 14.04 with openssh 6.6.1p1, bridged connection and tried to test this vulnerability, but with no success. No memory consumption (checking with htop from the VM...no more than 10MB increase).
I can ssh to the VM.
Tried with different maxconn (-n)
./kexkill -v -n 100 192.168.0.69
Has anyone exploited this vulnerability with success? Under some other conditions, openssh-server version? I couldn't find much info online.
Thanks!
The text was updated successfully, but these errors were encountered: