FreeBSD Security Advisory FreeBSD-SA-23:19.openssh

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-23:19.openssh                                    Security Advisory
                                                          The FreeBSD Project

Topic:          Prefix Truncation Attack in the SSH protocol

Category:       contrib
Module:         openssh
Announced:      2023-12-19
Credits:        Fabian Bäumer, Marcus Brinkmann, Jörg Schwenk
Affects:        All supported versions of FreeBSD.
Corrected:      2023-12-18 16:54:31 UTC (stable/14, 14.0-STABLE)
                2023-12-19 20:19:48 UTC (releng/14.0, 14.0-RELEASE-p4)
                2023-12-18 17:10:15 UTC (stable/13, 13.2-STABLE)
                2023-12-19 20:19:57 UTC (releng/13.2, 13.2-RELEASE-p9)
CVE Name:       CVE-2023-48795

Note: While this issue does affect 12.4-STABLE and 12.4-RELEASE, the version
of OpenSSH in 12.4 is old enough the vendor provided patch does not cleanly
apply. As 12.4 goes out of support at the end of December and in order to
quickly get fixes out for 14.0 and 13.2, the FreeBSD Security Team is issuing
this advisory now while feasibility of a 12.4 backport is investigated. Users
with 12.4 are encouraged to either implement the documented workaround or
leverage an up to date version of OpenSSH from the ports/pkg collection.

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted and authenticated transport for a variety of services, including
remote shell access.

II.  Problem Description

The SSH protocol executes an initial handshake between the server and the
client. This protocol handshake includes the possibility of several
extensions allowing different options to be selected. Validation of the
packets in the handshake is done through sequence numbers.

III. Impact

A man in the middle attacker can silently manipulate handshake messages to
truncate extension negotiation messages potentially leading to less secure
client authentication algorithms or deactivating keystroke timing attack
countermeasures.

IV.  Workaround

Add the following lines to /etc/ssh_config and /etc/sshd_config:
  Ciphers -chacha20-poly1305@openssh.com
  MACs -*etm@openssh.com

V.   Solution

Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

Perform one of the following:

1) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the amd64 or arm64 platforms,
or the i386 platfrom on FreeBSD 13 and earlier, can be updated via
the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

2) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch https://security.FreeBSD.org/patches/SA-23:19/openssh.patch
# fetch https://security.FreeBSD.org/patches/SA-23:19/openssh.patch.asc
# gpg --verify openssh.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart the applicable daemons, or reboot the system.

VI.  Correction details

This issue is corrected as of the corresponding Git commit hash or Subversion
revision number in the following stable and release branches:

Branch/path                             Hash                     Revision
- -------------------------------------------------------------------------
stable/14/                              673d1ead65c9    stable/14-n266020
releng/14.0/                            b9856d61e99d  releng/14.0-n265399
stable/13/                              3bafcb9744c9    stable/13-n256910
releng/13.2/                            69bd68ba30c0  releng/13.2-n254651
- -------------------------------------------------------------------------

Run the following command to see which files were modified by a
particular commit:

# git show --stat <commit hash>

Or visit the following URL, replacing NNNNNN with the hash:

<URL:https://cgit.freebsd.org/src/commit/?id=NNNNNN>

To determine the commit count in a working tree (for comparison against
nNNNNNN in the table above), run:

# git rev-list --count --first-parent HEAD

VII. References

<URL:https://terrapin-attack.com/>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-23:19.openssh.asc>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEthUnfoEIffdcgYM7bljekB8AGu8FAmWB/ZIACgkQbljekB8A
Gu8exRAA5OqnHpTSa3cPpnfBJNyJsWqD1bry8M8fxt6OpD3b8l/pVnH6HMaUSdQ/
K4SebhwVJgq4sIfTILWey5X3EKOsp2CpRZb6K+h7iKtrGdDVbXWQj7Dbi5/cCTy6
hdCSWqFwGJq/FpX15osAa2eEhv9DizE6jmYJ6YwnAfqLvvDSCVbtjeWs6wBJHeH3
q5jlvdiAT64fhWBpC51MeLShLDG95hJEHAfloVaN0asAs0jYj73XFzcoPv+1Cf8J
qURC5d6KlGYTyaF2ltiQTtssB8I+vhb+GQOyk01t4oyUPnU3myTiooW873xE0321
as1UeXmzTjuaD/V/5QFawIWbnKOKoVP745llvDyJsF0dLf2Se45vndRH3fP7CdVK
SPy3/u1ohkwNlm11RmeKSm2LbCa4RUwGZ3CqnEQ+dgYa6HBTATP68rWsaL4kIR/b
N30AGeW8xMbhTSFsHYNn3rQ+2RnHCzlSN7eKGfdd9yBVwsRls0ckVVgldmyR26lQ
7eYCbFMAdSCL45qKgYNww8PWSB1ge7AxnlC1MHPAct+kr6TrBwG4b6SAlI7GiDRP
zzqOG2o6k2pEetvn3suLmoMYmmBVZYwzITHUFvyEF1UwF00QCa68xoUW0s2haWnJ
riv7Wewt8m/vUXQ2ad2noElL31hdoRusaKCKVIVOKsCCvwAB/WI=
=RQjY
-----END PGP SIGNATURE-----