Описание
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
A flaw was found in OpenSSH. A use-after-free vulnerability exists in the ssh client when handling concurrent remote-forwarding operations. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote attacker with high attack complexity could potentially exploit this to achieve low impact on confidentiality and integrity.
Отчет
A use-after-free flaw exists in OpenSSH's ssh client during concurrent remote-forwarding processing. When adding a remote forward via the local session multiplexing socket while a server remote-forward open request is pending, realloc data management fails, freeing memory that remains actively referenced. A remote attacker with high attack complexity can exploit this timing window to corrupt process memory, posing a low impact to confidentiality, integrity, and availability.
Меры по смягчению последствий
Avoid issuing dynamic remote-forwarding commands over active SSH multiplexing connections, or disable socket multiplexing by setting ControlMaster no in ~/.ssh/config.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | openssh | Fix deferred | ||
| Red Hat Enterprise Linux 7 | openssh | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | openssh | Fixed | RHSA-2026:69129 | 21.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | openssh | Fixed | RHSA-2026:76748 | 06.10.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:69266 | 21.09.2026 |
| Red Hat Enterprise Linux 8 | openssh | Fixed | RHSA-2026:69266 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:69130 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | openssh | Fixed | RHSA-2026:69130 | 21.09.2026 |
Показывать по
Дополнительная информация
Статус:
5.6 Medium
CVSS3
Связанные уязвимости
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can o ...
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent.
5.6 Medium
CVSS3