CVE-2020-29652

Root

Cause The vulnerability is a nil pointer dereference in the golang.org/x/crypto/ssh package (versions before v0.0.0-20201216223049-8b5274cf687f). When an SSH server is configured without setting the GSSAPIWithMICConfig field in ServerConfig, a client can send an authentication request for the "gssapi-with-mic" method, causing NewServerConn to panic due to a nil pointer dereference [3][4].

Exploitation

A remote, unauthenticated attacker can exploit this by initiating an SSH connection to the affected server and sending a crafted authentication request for the "gssapi-with-mic" method, even if the server does not advertise support for GSSAPI. No prior authentication is required, and the attacker only needs network access to the SSH server [2][4].

Impact

Successful exploitation results in a denial of service (DoS) condition, crashing the SSH server process. This can disrupt legitimate SSH access and potentially affect other services relying on the same process. The vulnerability does not lead to remote code execution or data disclosure [1][2].

Mitigation

The fix is included in golang.org/x/crypto version v0.0.0-20201216223049-8b5274cf687f and later, committed to the repository in commit 8b5274cf687fd9316b4108863654cc57385531e8 [3]. Users should update their dependency to this version or later. The vulnerability was discovered and reported by Joern Schneeweisz of the GitLab Security Research Team [4].