CVE-2025-26466

Published Feb 28, 2025

Last updated 13 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-26466 is a pre-authentication denial-of-service (DoS) vulnerability affecting both OpenSSH clients and servers. It involves asymmetric resource consumption, meaning an attacker can use minimal resources to cause significant memory and CPU usage on the target system. This was introduced around August 2023, before the release of OpenSSH 9.5p1. The vulnerability stems from how OpenSSH manages SSH handshake messages, specifically the SSH2_MSG_PING and SSH2_MSG_PONG exchange. An attacker floods the server with SSH2_MSG_PING packets. The server allocates memory for SSH2_MSG_PONG responses but doesn't immediately process or free this memory during key exchange. This accumulation of unfreed memory can lead to resource exhaustion and a denial-of-service condition. OpenSSH 9.9p2 addresses this vulnerability. Existing OpenSSH server mechanisms like LoginGraceTime, MaxStartups, and PerSourcePenalties can mitigate this attack.

Description: A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

secalert@redhat.com: CWE-770
nvd@nist.gov: CWE-770

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.5:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B95D97F9-56D8-4A03-8D97-C9C3BC103AEA"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.6:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2AFDD23D-3B76-4942-B222-843918EE7996"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.6:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EA15AB35-EE6C-4435-9CD3-02E77A581CCD"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.7:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "35061B84-4628-469C-BEC2-06207F066F30"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.7:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E0DA97F7-489E-416E-9A01-DE7E4ABB8E47"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.8:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF2C0441-653D-4BD3-A45D-D97C929A596F"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.8:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "63A10946-C4A4-4F77-828D-568579A2599C"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E2B53BBB-6916-478C-A896-77C7F7E7D5DE"
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.9:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F7A2B794-BA83-4A01-BD2E-541F18CB9E37"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF90B5A4-6E55-4369-B9D4-E7A061E797D2"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:24.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DE07EF30-B50E-4054-9918-50EFA416073B"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "46D69DCC-AE4D-4EA5-861C-D60951444C6C"
          },
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "204FC6CC-9DAC-45FB-8A9F-C9C8EDD29D54"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]