| 제목 | warmcat libwebsockets 4.5.99-v4.5.0-382-g4a63b9333 Uncontrolled Memory Allocation |
|---|
| 설명 | Missing upper-bound check on msg_len in lws_ssh_parse_plaintext() causes pre-auth OOM server kill via unbounded allocation
plugins/protocol_lws_ssh_base/sshd.c:576 constructs pss->msg_len from 4
attacker-controlled bytes without any upper-bound check. The only validation
(line 595) rejects msg_len < 6. When msg_id == SSH_MSG_KEXINIT (20), the
value is passed directly to sshd_zalloc() at line 652, allowing an
unauthenticated remote attacker to trigger a ~128 MB (or up to ~4 GB)
heap allocation per connection. Repeated connections exhaust system memory,
causing the server process (and potentially other processes) to be killed
by the OOM killer.
Version: 4.5.99-v4.5.0-382-g4a63b9333
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Score: 7.5
Scope is Changed because unbounded memory consumption by the SSH server
exhausts system-wide memory, causing the OOM killer to terminate other
resident processes. Confirmed by testing: without cgroup memory limits
the entire host became unstable and required a hard reset.
Root cause (plugins/protocol_lws_ssh_base/sshd.c):
/* line 575-578 — msg_len assembled from 4 attacker bytes, no upper bound */
case SSHS_MSG_LEN:
pss->msg_len = (pss->msg_len << 8) | *p++;
if (++pss->ctr != 4)
break;
/* line 595-598 — only lower-bound check */
if (pss->msg_len < 2 + 4) {
lwsl_notice("illegal msg size\n");
goto bail;
}
/* line 649-656 — msg_len used directly as allocation size */
case SSH_MSG_KEXINIT:
...
pss->kex->I_C_alloc_len = pss->msg_len;
pss->kex->I_C = sshd_zalloc(pss->kex->I_C_alloc_len);
if (!pss->kex->I_C) {
lwsl_notice("OOM 3\n");
goto bail;
}
/* sshd_zalloc (line 31-38) — malloc + memset, commits physical pages */
void *sshd_zalloc(size_t s)
{
void *p = malloc(s);
if (p)
memset(p, 0, s);
return p;
}
PoC: poc_sshd_unbounded_alloc.py (sends a minimal crafted binary packet available upon request)
The vulnerable code is in the SSH protocol plugin library.
libwebsockets-test-sshd was used as the harness that accepts SSH connections
via the lws-ssh-base plugin. Any application using this plugin is equally vulnerable.
Run:
# Terminal 1:
./build/bin/libwebsockets-test-sshd -d 7
# Terminal 2: run PoC
python3 poc_sshd_unbounded_alloc.py 127.0.0.1 2200
OOM kill evidence (systemd journal):
run-p4239-i4240.scope: A process of this unit has been killed by the OOM killer.
run-p4239-i4240.scope: Failed with result 'oom-kill'.
run-p4239-i4240.scope: Consumed 303ms CPU time, xxx memory peak.
Impact:
- Denial of Service — a single unauthenticated attacker can kill the SSH
server by sending 20-byte crafted packets across a few TCP connections
- System-wide impact — without cgroup memory limits, the unbounded
allocation exhausts host memory, causing the OOM killer to terminate
other processes and potentially destabilizing the entire system
- Pre-authentication — the entire attack occurs during the SSH banner
exchange and KEX_INIT phase, before any key exchange or authentication
- Zero complexity and deterministic
- Affects any application using the lws-ssh-base protocol plugin
reference: https://github.com/warmcat/libwebsockets/commit/7223d9e5f5c2481dea0f8f63e390cf6ceb9308fe |
|---|
| 원천 | ⚠️ https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc |
|---|
| 사용자 | biniam (UID 94731) |
|---|
| 제출 | 2026. 05. 14. PM 11:54 (21 날 ago) |
|---|
| 모더레이션 | 2026. 06. 02. PM 05:19 (19 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 367955 [warmcat libwebsockets 까지 4.5.8 SSH Protocol sshd.c lws_ssh_parse_plaintext msg_len 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|