russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and appends every Constraint::Confirm record to the key's retained constraint vector without a count or memory limit. A process that can connect to the agent socket, including the remote side of a forwarded agent session, can repeatedly add constrained keys and cause renewable memory growth that persists for the process lifetime because keys without a lifetime constraint do not expire. This issue is fixed in version 0.65.0.

[ Fixes ]Fixes and patches

• russh 0.65.0Fixed version · GitHub Advisories · rust package russh: upgrade to 0.65.0 or later (affected < 0.65.0)

[ Packages ]Affected open-source packages

• russh rustAffected < 0.65.0 · fixed in 0.65.0 · GHSA-9wfm-jcj8-jfv9

[ References ]References

• github.com/Eugeny/russh/commit/23aa5d28fe9601c5bdfe9e60b7ec5d4f882c3de6
• github.com/Eugeny/russh/releases/tag/v0.65.0
• github.com/Eugeny/russh/security/advisories/GHSA-9wfm-jcj8-jfv9