From 2c34666e084654943319a687227caca35536daa2 Mon Sep 17 00:00:00 2001 From: "djm@openbsd.org" Date: Fri, 30 Oct 2026 05:21:48 +0000 Subject: [PATCH] upstream: don't let SSH_MSG_PONG replies pile up if the peer isn't sending ACKs and there is a significant amount of data in data in out transport obuf. Avoids an obscure post-auth soft memory DoS Anthropic ANT-2026-Z4SZFUYY OpenBSD-Commit-ID: 55eb6b4d171008321f5c16cf1b1fdfeeadc7cff8 --- PROTOCOL | 8 +++++--- packet.c | 7 ++++++- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/PROTOCOL b/PROTOCOL index 06081f82a..1ca2dfd83 100644 --- a/PROTOCOL +++ b/PROTOCOL @@ -110,8 +110,10 @@ ping: byte SSH_MSG_PONG string data -Replies are sent in order. They are sent immediately except when rekeying -is in progress, in which case they are queued until rekeying completes. +Replies are sent in order. No reply is sent to a ping that is received +before authentication has completed, while rekeying is in progress or +while the peer has not yet read a significant amount of previously sent +data. The server advertises support for these messages using the SSH2_MSG_EXT_INFO mechanism (RFC8308), with the following message: @@ -718,4 +720,4 @@ master instance and later clients. OpenSSH extends the usual agent protocol. These changes are documented in the PROTOCOL.agent file. -$OpenBSD: PROTOCOL,v 1.60 2026/02/09 22:09:48 dtucker Exp $ +$OpenBSD: PROTOCOL,v 1.61 2026/10/30 05:21:48 djm Exp $ diff --git a/packet.c b/packet.c index 462df2847..bf556c680 100644 --- a/packet.c +++ b/packet.c @@ -1,4 +1,4 @@ -/* $OpenBSD: packet.c,v 1.347 2026/10/30 04:36:21 djm Exp $ */ +/* $OpenBSD: packet.c,v 1.348 2026/10/30 05:21:48 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1947,6 +1947,11 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, uint32_t *seqnr_p) DBG(debug("Won't reply to PING during KEX")); break; } + /* Don't let replies pile up if the peer isn't reading */ + if (!ssh_packet_not_very_much_data_to_write(ssh)) { + DBG(debug("Won't reply to PING with backlog")); + break; + } if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 || (r = sshpkt_put_string(ssh, d, len)) != 0 || (r = sshpkt_send(ssh)) != 0)