Exposed sshd -- looping sshd-auth

[Havard Eidnes]

Hi,

as my alter ego, he at NetBSD.org, I posted this problem report to
NetBSD's problem report collection:

  https://gnats.netbsd.org/60563

In short: an Internet-exposed sshd running newish OpenSSH but
which dis-allows any keyboard-interactive / password logins seems
to be vulnerable to what I call a mild DoS attack, in that it may
be triggered into doing a fairly tight system call loop until the
parent process says "enough" or a self-imposed CPU time resource
limit of 10 minutes is reached.

I'm seeing this with OpenSSH 10.4p1 and 10.5p1, it is somewhat
unclear to me when the behaviour was introduced, though I try to
keep abreast with having an up-to-date package installed, and the
first version I saw this with was 10.4p1.

I am seeing probing / "door-knocking" from both Chinese and
Russian IP addresses triggering this behaviour, and I'm blocking
those addresses/routes at least temporarily from reaching those
exposed hosts.

A "ktrace -p" of one such process might look like this (see also
the PR):

  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN
  9980      1 sshd-auth poll(0x7f7fffffe4b0, 0x1, 0xffffffff) = 1
  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN
  9980      1 sshd-auth poll(0x7f7fffffe4b0, 0x1, 0xffffffff) = 1
  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN
  9980      1 sshd-auth poll(0x7f7fffffe4b0, 0x1, 0xffffffff) = 1
  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN
  9980      1 sshd-auth poll(0x7f7fffffe4b0, 0x1, 0xffffffff) = 1
  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN
  9980      1 sshd-auth poll(0x7f7fffffe4b0, 0x1, 0xffffffff) = 1
  9980      1 sshd-auth read(0x5, 0x7f7fffffe53f, 0x1) Err#35 EAGAIN

A stack backtrace:

mt# gdb /usr/pkg/libexec/sshd-auth
GNU gdb (GDB) 8.3
...
(gdb) attach 9980
Attaching to program: /usr/pkg/libexec/sshd-auth, process 9980
Reading symbols from /usr/lib/libpam.so.4...
Reading symbols from /usr/libdata/debug//usr/lib/libpam.so.4.1.debug...
Reading symbols from /usr/lib/libutil.so.7...
Reading symbols from /usr/libdata/debug//usr/lib/libutil.so.7.24.debug...
Reading symbols from /usr/lib/libcrypto.so.14...
Reading symbols from /usr/libdata/debug//usr/lib/libcrypto.so.14.1.debug...
Reading symbols from /usr/lib/libcrypt.so.1...
Reading symbols from /usr/libdata/debug//usr/lib/libcrypt.so.1.0.debug...
Reading symbols from /usr/lib/libz.so.1...
Reading symbols from /usr/libdata/debug//usr/lib/libz.so.1.0.debug...
Reading symbols from /usr/lib/libgcc_s.so.1...
Reading symbols from /usr/libdata/debug//usr/lib/libgcc_s.so.1.0.debug...
Reading symbols from /usr/lib/libc.so.12...
Reading symbols from /usr/libdata/debug//usr/lib/libc.so.12.213.1.debug...
Reading symbols from /usr/libexec/ld.elf_so...
Reading symbols from /usr/libdata/debug//usr/libexec/ld.elf_so.debug...
[Switching to LWP 1 of process 9980]
0x00007f7ff5c42d7a in poll () from /usr/lib/libc.so.12
(gdb) where
#0  0x00007f7ff5c42d7a in poll () from /usr/lib/libc.so.12
#1  0x000000000026c925 in atomicio6 (f=f at entry=0x27c4a0 <read>, fd=5, 
    _s=_s at entry=0x7f7fffffe53f, n=n at entry=1, cb=cb at entry=0x0, 
    cb_arg=cb_arg at entry=0x0) at atomicio.c:71
#2  0x000000000026c937 in atomicio (f=f at entry=0x27c4a0 <read>, 
    fd=<optimized out>, _s=_s at entry=0x7f7fffffe53f, n=n at entry=1)
    at atomicio.c:92
#3  0x000000000027f5fb in kex_exchange_identification (ssh=0x7f7ff7ebe000, 
    timeout_ms=<optimized out>, version_addendum=<optimized out>) at kex.c:1322
#4  0x00000000002ac68f in do_ssh2_kex (ssh=0x7f7ff7ebe000) at sshd-auth.c:787
#5  main (ac=<optimized out>, av=<optimized out>) at sshd-auth.c:735
(gdb) 

Another process:

[Switching to LWP 1 of process 22739]
0x00007f7ff5c42d1a in read () from /usr/lib/libc.so.12
(gdb) where
#0  0x00007f7ff5c42d1a in read () from /usr/lib/libc.so.12
#1  0x000000000026c868 in atomicio6 (f=f at entry=0x27c4a0 <read>, fd=5, 
    _s=_s at entry=0x7f7fffffe53f, n=n at entry=1, cb=cb at entry=0x0, 
    cb_arg=cb_arg at entry=0x0) at atomicio.c:60
#2  0x000000000026c937 in atomicio (f=f at entry=0x27c4a0 <read>, 
    fd=<optimized out>, _s=_s at entry=0x7f7fffffe53f, n=n at entry=1)
    at atomicio.c:92
#3  0x000000000027f5fb in kex_exchange_identification (ssh=0x7f7ff7ebe000, 
    timeout_ms=<optimized out>, version_addendum=<optimized out>) at kex.c:1322
#4  0x00000000002ac68f in do_ssh2_kex (ssh=0x7f7ff7ebe000) at sshd-auth.c:787
#5  main (ac=<optimized out>, av=<optimized out>) at sshd-auth.c:735
(gdb)

(This is with ASLR turned off in sshd-auth, to ease debugging.)

Hopefully this can help narrowing down what's causing the
observed behaviour.

Best regards,

- Havard