Erlang/OTP SSH Timing Oracle Vulnerability GHSA-3dp9-vwrf-wqpd and Fix

Vulnerability Overview This vulnerability involves a timing oracle in SSH password authentication. Attackers can enumerate valid usernames by measuring differences in password verification time. Specifically, when password authentication is performed using , the verification process returns immediately if the username is invalid. However, if the username is valid, the full password verification process is executed, resulting in a measurable time difference. Scope Affected Component: SSH password authentication module Affected Version: Erlang/OTP 29.0.2 Attack Vector: Attackers can enumerate valid usernames by measuring differences in password verification time Remediation 1. Pre-compute password verification time for invalid users: Calculate the password verification time for invalid users at daemon startup, ensuring that the verification time is the same for both valid and invalid users. 2. Update hardening guidelines: Warn in the hardening guidelines that the implementation should use constant-time comparison to avoid timing differences based on the username. 3. Add timing symmetry tests: Add timing symmetry tests for password and public key authentication paths in . POC Code Below are the code changes involved in the remediation: erlang fun(User, Password, PeerAddress, State) -> case lists:member({User, Password}, my_user_pwds()) of case check_credentials(User, Password) of true -> {true, undefined}; % Reset delay time false when State == undefined -> % Pre-compute time for invalid users {false, undefined}; false -> {false, undefined} end end end. erlang %% Run fake PBD2 to prevent timing oracle (GHSA-3dp9-vwrf-wqpd) case ?PUT_INTERNAL_OPT(fake_passwd_checker, Options) of {false, Ssn} -> end end end. erlang %% Enter the user's values into the map; unknown keys are %% treated as socket options check_and_save(OptList2, OptionDefinitions, InitialMap) -> maybe_add_fake_passwd_checker(NoRe, check_and_save(OptList2, OptionDefinitions, InitialMap)) catch error(E0, KV, Reason) when E0 =:= options ; E0 =:= erl_err -> if lists:foldl(fun({KV, Vals}) -> save(KV, OptionDefinitions, Vals) end, InitialMap, Optalist)). erlang %% Verify that password auth timing does not reveal username validity. %% Regression test for GHSA-3dp9-vwrf-wqpd. server_userpassword_timing(Config) when is_list(Config) -> UserDir = proplists:get_value(user_dir, Config), SysDir = proplists:get_value(data_dir, Config), {Pid, Host, Port} = ssh_test_lib:daemon([{system_dir, SysDir}, {user_dir, UserDir}, {auth_methods, ["password"]}, {user_passwords, [{"alice", "secret"}]}]). Opts = [{silent_accept_hosts, true}, {user_interaction, false}, {save_accepted_host, false}, {auth_methods, ["password"]}, {user_dir, UserDir}, {password, "wrong"}], F = fun(User) -> time_auth(Host, Port, User, Opts) end, ssh_test_lib:assert_timing_symmetry(F, "alice", "invalid"), ssh:stop_daemon(Pid). erlang %% Assert timing symmetry between valid and invalid inputs assert_timing_symmetry(MeasureFun, ValidInput, InvalidInput) -> Warmup = 3, CollectSamples = fun(Input) -> begin ?CT_LOG("Collecting sample #~p of total ~p.", [I, N]), MeasureFun(Input) end Warmup + 1, N - Warmup end, MV = median(CollectSamples(ValidInput)), MI = median(CollectSamples(InvalidInput)), Ratio = max(MV / MI, MI / MV), ?CT_LOG("ValidInput=MI, InvalidInput=MI, Ratio=~p ms, Ratio=~2f", [ValidInput, MI, InvalidInput, MI, Ratio]), case Ratio > 3.0 of true -> ct:fail("Timing ratio ~.2f exceeds 3.0 -- possible timing oracle", [Ratio]); false -> ok end. ``` Summary The remediation effectively prevents timing attacks in SSH password authentication by pre-computing password verification time for invalid users, updating hardening guidelines, and adding timing symmetry tests.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP SSH Timing Oracle Vulnerability GHSA-3dp9-vwrf-wqpd and Fix

More from this source