Executive brief
A vulnerability exists in OpenSSH, a widely used tool for secure remote access to servers. When a specific DNS verification setting is enabled, a sophisticated attacker could potentially intercept and manipulate the connection between a user and a server. This could allow the attacker to impersonate a legitimate server to steal sensitive information or credentials, though the attack is difficult to perform as it requires exhausting the target's system memory first.
Technical details
A vulnerability (CWE-390) exists in OpenSSH when the 'VerifyHostKeyDNS' option is enabled. The issue stems from the mishandling of error codes during host key verification via DNS. A remote attacker can perform a machine-in-the-middle (MitM) attack by impersonating a legitimate server. To successfully exploit this, the attacker must first trigger a memory exhaustion condition on the client to influence the error handling path. This high complexity requirement mitigates the risk. Patches have been released by OpenBSD (008_ssh.patch) and various Linux distributions including Red Hat and Debian.
Affected products
- OpenBSD OpenSSH 6.9 through 9.8, 9.9, 9.9p1
- Red Hat Enterprise Linux 8, 9.4
- Debian Debian Linux 11.0, 12.0
Timeline
- 2025-02-18: disclosed: Vulnerability disclosed by Qualys TRU
- 2025-02-18: advisory
- 2025-02-18: patched: OpenBSD released patch 008_ssh.patch
References
- https://access.redhat.com/errata/RHSA-2025:16823
- https://access.redhat.com/errata/RHSA-2025:3837
- https://access.redhat.com/errata/RHSA-2025:6993
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2025-26465
- https://access.redhat.com/solutions/7109879
- https://bugzilla.redhat.com/show_bug.cgi?id=2344780