Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)

[Demi Marie Obenour <demi () invisiblethingslab com>]

On Wed, Feb 22, 2023 at 05:54:36AM +0000, Qualys Security Advisory wrote:
> Hi all,
>
> Another quick update on the exploitation of this double-free bug on
> OpenBSD:
>
> a/ our previous attack (the arbitrary control of sshd's instruction
> pointer via the EVP_AES_KEY structure) works only on OpenBSD amd64, not
> on OpenBSD i386;
>
> b/ we were able to recycle the chunk of memory where
> options.kex_algorithms was allocated, into a chunk of a different size
> (which gives us greater freedom), but this happens with such a low
> probability (even on i386) that we do not consider this particular
> attack to be practical;
>
> c/ as a direct consequence of CVE-2023-25136, we found an information
> leak (of bits and pieces from the memory of the unprivileged sshd
> process), but it is unlikely to be useful in practice.

Is it possible to use this information leak to bypass ASLR without
crashing the process?  If so, then one could use the control of the
instruction pointer to jump to a ROP chain and get code execution.
This flaw would then be at least the third RCE in OpenBSD’s default
install, and the second in OpenSSH.

Also, is this flaw expected to be exploitable for code execution on
GNU/Linux?
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

Attachment: signature.asc
Description: