Bug 3256 - Illegal Instruction
Summary: Illegal Instruction
Status: CLOSED DUPLICATE of bug 3250
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: 8.4p1
Hardware: amd64 Linux
: P5 security
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-01-25 05:34 AEDT by Carlos Ramirez
Modified: 2021-03-04 09:52 AEDT (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos Ramirez 2021-01-25 05:34:42 AEDT
Specially crafted input in configuration files triggers an "Illegal Instruction" from both, server and client application when supplied particular values for the RekeyLimit parameter. The issue usually impacts 
 scan_scaled() in fmt_scaled.c - Size of the supplied buffer seems to influence how the problem triggers.

scan_scaled()
// Line 198:
// scale_fact is zero, scale_fact largely varies depending on input
fpart *= scale_fact; // Illegal instruction

As RekeyLimit limits the amount of data transmitted with a single session key, there could be some security impact if the bug is triggered intentionally or unintentionally in the configuration file. Further investigation is required. Keeping this ticket as private for now.

Impact
- Availability of application
- Further impact needs to be investigated

Attached is PoC that triggers the issue.

PoC command:
/usr/sbin/sshd -f illegal-instruction.txt

NOTE: Graceful error handling should emit an error such as:
"Bad number '-4.4P1111111111111P': Invalid argument"

When the actual illegal instruction is triggered, two messages have been seen:
"Illegal instruction" or simply "Aborted"

See attached file "illegal-instruction.txt"
Comment 1 Carlos Ramirez 2021-01-25 05:37:08 AEDT
Missing attachment in main post.
Here is the contents of PoC file, use it as config file:


RekeyLimit -4.411111111111111111111111111P
Comment 2 Damien Miller 2021-01-25 10:44:12 AEDT
This is the convtime() integer overflow that was recently fixed, it's a SIGILL because we set -ftrapv that deliberately faults the process whenever one occurs.

*** This bug has been marked as a duplicate of bug 3250 ***
Comment 3 Damien Miller 2021-03-04 09:52:51 AEDT
close bugs that were resolved in OpenSSH 8.5 release cycle