[Bug 4034] New: 10.6: malformed SOCKS5 request terminates the ssh client

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=4034

            Bug ID: 4034
           Summary: 10.6: malformed SOCKS5 request terminates the ssh
                    client
           Product: Portable OpenSSH
           Version: 10.6p1
          Hardware: amd64
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ssh
          Assignee: unassigned-bugs at mindrot.org
          Reporter: kmehltretter at gmail.com

channel_decode_socks5() continues parsing when a SOCKS5 client sends
its authentication greeting and request in one buffer. The caller
selected the decoder using the greeting's first byte, but the next byte
read after authentication is the request version. The decoder treats a
request version other than 5 as an internal invariant failure and calls
fatal().

An unauthenticated peer can therefore terminate the entire ssh process
by sending these four bytes to a reachable DynamicForward listener:

    05 01 00 ff

The first three bytes are a valid SOCKS5 no-authentication greeting.
The last byte is an invalid version for the immediately coalesced
request. A default DynamicForward listener is loopback-only, but other
local users can reach it. An explicit bind address or GatewayPorts may
expose it to a network. If the ssh process is a multiplex master,
terminating it also drops its other sessions and forwardings.

A listener-free socketpair probe feeds the bytes to an accepted dynamic
channel and enters channel_prepare_poll():

               exit status  result
  unpatched             255  fatal: internal error: not socks5: success
  patched                 0  ssh survives; malformed channel fd closed

The regression was introduced by the January 2026 SOCKS parser rewrite
in commit a6f8f793d and is present in the 10.3p1 through 10.6p1 tags.
The older parser returned after authentication instead of speculatively
parsing a coalesced request.

In a local build, the fix closes only the malformed channel. The 871
fast tests pass; sanitizer, two 30-second fuzz runs, and focused Clang
checks found no further issues. Found while adding stateful SOCKS
parsing to a fuzzer with LLM assistance.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.