russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang)
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable in russh/src/channels/io/tx.rs. The Channel::data, Channel::make_writer, and Channel::into_stream asynchronous write paths then calculate a writable size of zero and remain pending forever because window adjustments cannot satisfy a static zero packet maximum. An authenticated client can strand server writes, and a malicious server can strand client writes, allowing affected tasks, channels, and connections to accumulate without surfacing an error. This issue is fixed in version 0.65.0.
Text from CVE List
Affected versions 1
- russhaffected: >= 0.60.0, < 0.65.0CVE List