Michał Wąsowski

Resource allocation without limits in the certificate path validation of the public key module allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted X.509 certificate chain during a TLS handshake, an attacker can trigger unbounded growth of the certificate policy tree during RFC 5280 policy processing in the `pkix path validation/3` function. This occurs because the functions `pubkey policy tree:add leaves/2` and `pubkey policy tree:add leaf siblings/2` extend the tree per policy per certificate, leading to exponential growth. This can pin BEAM schedulers and exhaust node memory, resulting in a complete virtual machine crash. The issue affects any incoming or outgoing TLS connection that validates the peer's chain, such as SSL/TLS clients and mutual-TLS servers.

An observable response discrepancy in the `ssh sftpd` module allows an authenticated SFTP user to enumerate files and directories outside the configured root directory. The `SSH FXP REALPATH` handler calls `relate file name/3` with `Canonicalize=false`, which allows path traversal components to bypass the `is within root/2` check. The path then enters `resolve symlinks/2`, which performs `read link()` syscalls on arbitrary filesystem paths. An attacker can use a crafted traversal path in a REALPATH request to create a path-existence oracle, as the server returns `SSH FXP NAME` if the path exists and `SSH FX NO SUCH FILE` if it does not. This issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and the function `ssh sftpd:handle op/4`. This flaw only leaks the existence of paths and does not provide access to file contents or credentials.

An infinite loop exists in the `ssh sftpd` module of Erlang OTP. An authenticated SFTP user can cause an SFTP channel to become permanently unresponsive by sending `SSH MSG CHANNEL EXTENDED DATA` with a non-zero type code, an empty pending buffer, and a payload within the SFTP packet size limit. This triggers a tail-recursive loop in the `handle data()` function, causing the process to stop processing messages and leading to unbounded message queue memory growth and high CPU consumption. The impact is a denial of service on targeted SFTP channels. This effect can be amplified if the `max channels` setting is set to infinity, allowing a single user to open unlimited channels.

A timing side-channel in password authentication allows unauthenticated remote attackers to enumerate usernames. When the SSH daemon is configured with the `user passwords` or `password` option, the `check password/3()` function in the `ssh auth` module performs a PBKDF2-SHA256 computation for valid usernames, taking approximately 300ms. Conversely, for invalid usernames, the `get password option/2()` function in the `ssh options` module returns immediately. This discrepancy allows an attacker to distinguish between valid and invalid usernames in a single attempt.

An issue in the `ssh sftpd` module allows for file discovery through the exposure of sensitive information. The `SSH FXP READLINK` handler sends the raw result of the `file:read link/2` function to the client without using `chroot filename/2` to remove the backend root prefix. Consequently, an authenticated SFTP client can create a symlink inside the chroot pointing to `/`, and reading it back via `SSH FXP READLINK` returns the absolute backend root path (e.g., `/data/sftp`) instead of the chrooted value `/`. This discloses the absolute filesystem path of the SFTP root directory and any symlink targets within it, although file contents, credentials, and paths outside the root directory remain inaccessible. This issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and requires the SFTP subsystem to be enabled with the `root` option configured in the `ssh sftpd:subsystem spec/1` call.

A path traversal issue in the Erlang OTP ssh `ssh sftpd` module allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When `SSH FXP FSETSTAT` is issued on such a handle, file attributes like permissions, ownership, and timestamps are modified on the real filesystem path, bypassing the root directory boundary. This requires the server to be configured with the root option and for the target file to exist on the real filesystem at the same relative path. This flaw only allows the modification of file attributes; file contents cannot be read or altered. If the SSH daemon runs as root, an attacker can achieve privilege escalation by setting the setuid bit on binaries, changing ownership of sensitive files, or making system configurations world-writable. The issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and the functions `ssh sftpd:do open/4` and `ssh sftpd:handle op/4`.

An improper limitation of a pathname to a restricted directory, specifically a 'Path Traversal' issue, exists in the Erlang OTP `ssh sftpd` module. The SFTP server uses string prefix matching with the `lists:prefix/2` function instead of proper path component validation when verifying if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if the root directory is set to `/home/user1`, paths like `/home/user10` or `/home/user1 backup` could be incorrectly considered within the root. The issue is associated with the program file `lib/ssh/src/ssh sftpd.erl` and the `ssh sftpd:is within root/2` function.

An issue exists in Erlang OTP ssh (ssh transport modules) that allows for Denial of Service via Resource Depletion. The SSH transport layer, by default, advertises legacy zlib compression and inflates attacker-controlled payloads without a size limit before authentication. This enables a reliable memory exhaustion attack. Two compression algorithms are affected: zlib, which activates immediately after key exchange, and zlib@openssh.com, which activates post-authentication. Each SSH packet can decompress approximately 255 MB from 256 KB of data, resulting in a 1029:1 amplification ratio. Multiple packets can quickly exhaust available memory, potentially causing Out-Of-Memory (OOM) kills in environments with limited memory. The issue is associated with the `ssh transport.erl` file and the `ssh transport:decompress/2` and `ssh transport:handle packet part/4` routines.