Bug#984940: CVE-2021-28041

[Colin Watson]

On Wed, Mar 10, 2021 at 05:57:52PM +0100, Moritz Muehlenhoff wrote:
> The following vulnerability was published for openssh.
> 
> CVE-2021-28041[0]:
> | ssh-agent in OpenSSH before 8.5 has a double free that may be relevant
> | in a few less-common scenarios, such as unconstrained agent-socket
> | access on a legacy operating system, or the forwarding of an agent to
> | an attacker-controlled host.
> 
> Buster is not affected. Isolated patch at:
> https://github.com/openssh/openssh-portable/commit/e04fd6dde16de1cdc5a4d9946397ff60d96568db

This patch unfortunately doesn't apply terribly cleanly to OpenSSH
8.4p1, because it depends on some earlier refactoring, e.g.
37c70ea8d4f3664a88141bcdf0bf7a16bd5fd1ac.

If I understand the vulnerability correctly, then it seems to me that
the following shorter patch would fix it, and would run less risk of me
fouling something else up by backporting the refactoring wrongly:

diff --git a/ssh-agent.c b/ssh-agent.c
index e1fd1f3f6..b6ccbfb49 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -581,12 +581,14 @@ process_add_identity(SocketEntry *e)
 				goto err;
 			}
 			free(ext_name);
+			ext_name = NULL;
 			break;
 		default:
 			error("%s: Unknown constraint %d", __func__, ctype);
  err:
 			free(sk_provider);
 			free(ext_name);
+			ext_name = NULL;
 			sshbuf_reset(e->request);
 			free(comment);
 			sshkey_free(k);

But I think I should probably check this with upstream before applying
it, so CCing openssh-unix-dev for review.

Thanks,

-- 
Colin Watson (he/him)                              [cjwatson at debian.org]