[Bug 3986] New: ssh(1) ControlMaster remote-forward UAF: crash and demonstrated client-side code execution

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=3986

            Bug ID: 3986
           Summary: ssh(1) ControlMaster remote-forward UAF: crash and
                    demonstrated client-side code execution
           Product: Portable OpenSSH
           Version: 10.4p1
          Hardware: All
                OS: All
            Status: NEW
          Severity: critical
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: brian at cognatory.com

Created attachment 3975
  --> https://bugzilla.mindrot.org/attachment.cgi?id=3975&action=edit
Minimal reproducer + RCE + Diagram + Patch

Reporter: Brian Mingus, Cognatory, LLC <brian at cognatory.com>
Report date: 2026-08-03

OpenSSH ssh(1) registers a pointer into `options.remote_forwards` as
callback
context while a startup remote-forward reply is pending. A
ControlMaster mux
request can grow and relocate that array, leaving the pending callback
with a
stale pointer. Processing the delayed server reply then causes a heap
use-after-free (CWE-416).

The trigger requires an authenticated ControlMaster with a startup `-R`
reply
pending, plus a same-user process able to submit another remote forward
through
the master's control socket. The server cannot manufacture the local
mux
request by itself. Shared ControlMaster sockets in developer,
automation, or CI
environments are a plausible deployment scenario.

On OpenSSH_10.4p1 (portable commit
ec0485632885e0c533b35e5970e4b583781db83f), Linux/x86-64 and glibc 2.43,
the
minimal attachment consistently produces SIGSEGV and ASan reports an
8-byte
heap-use-after-free in `ssh_confirm_remote_forward()`. The lab-specific
second
attachment demonstrates saved-RIP control and code execution on that
exact
build. It uses same-user `/proc` access and build-specific offsets, so
it is
evidence of exploitability rather than a portable remote-only exploit.

The defect was introduced by Damien Miller (`djm`) on 2010-06-25 in
OpenBSD CVS
(portable commit 232cfb1b1d0dccee68b1d433e0b4e1aa74919fc9), when the
fixed
forwarding array was changed to reallocatable storage without replacing
the
pointer retained by pending callbacks.

A tested repair stores a stable forwarding index in separately
allocated
callback state, validates it, and resolves the current array entry when
the
reply arrives. Patched validation completed sanitizer, optimized
fanout,
multiplex, and forwarding-control tests without a signal.

Reproducer source, exploitability evidence, and the trust-boundary
architecture
diagram are supplied only as attachments.

Attachments to upload separately
--------------------------------

1. attachment-01-minimal-crash.py
   Minimal 36-line crash reproducer; text/x-python; requires Paramiko
4.0.0.
   Run: python attachment-01-minimal-crash.py /absolute/path/to/ssh

2. attachment-02-controlmaster-rce.py
   Lab-specific exploitability proof; text/x-python.
   Run: python attachment-02-controlmaster-rce.py /absolute/path/to/ssh

3. attachment-03-aws-solution-architecture.pdf
   Vector solution-architecture diagram of the required trust boundary,
   client compromise, and permissions-dependent post-execution paths.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.