Dear affected users, if you have the ability to rebuild the package, maybe you could test the attached patch. While I have the reproducer myself, it would be interesting to hear your feedback, from your real use-/testcases.
Sending here first, because this seems to be the only public bugreport on this issue. -- Alexander Sverdlin Siemens AG www.siemens.com
From 761eed619b4456771795a297fed3ef6694230212 Mon Sep 17 00:00:00 2001 From: Alexander Sverdlin <[email protected]> Date: Tue, 4 Aug 2026 13:23:52 +0200 Subject: [PATCH] signkey: fix assert when DROPBEAR_RSA_SHA1=0 When DROPBEAR_RSA_SHA1 is disabled but DROPBEAR_RSA is enabled, a remote client can abort the server process by authenticating with an RSA key using the legacy "ssh-rsa" (SHA-1) signature algorithm. Root cause: signature_type_from_name() had no match for "ssh-rsa" when DROPBEAR_RSA_SHA1=0 and fell through to signkey_type_from_name(), which returns DROPBEAR_SIGNKEY_RSA (value 0) because "ssh-rsa" is a key type name in signkey_names[]. That value is not DROPBEAR_SIGNATURE_NONE (90), so the guard in svr_auth_pubkey(): sigtype = signature_type_from_name(sigalgo, sigalgolen); /* returns 0 */ if (sigtype == DROPBEAR_SIGNATURE_NONE) { /* 0 != 90, passes */ send_msg_userauth_failure(0, 0); goto out; } ...lets the packet through with sigtype=0. The same call inside buf_verify() also returns 0, so the mismatch check passes too. rsa_pad_em() then receives sigtype=0, which matches neither DROPBEAR_SIGNATURE_RSA_SHA1 (100) nor DROPBEAR_SIGNATURE_RSA_SHA256 (101), and hits default: assert(0). Reproduction: connect with any SSH client using an RSA key and the ssh-rsa (SHA-1) signature algorithm against a server built with DROPBEAR_RSA_SHA1=0. The Renci.SshNet client does this by default. Fix: signature_type_from_name() now calls signkey_type_from_name() first. "ssh-rsa" is the only RSA signature algorithm name that also appears in signkey_names[], so keytype == DROPBEAR_SIGNKEY_RSA is the exact test for it without a redundant string comparison. When DROPBEAR_RSA_SHA1 is disabled that branch returns DROPBEAR_SIGNATURE_NONE, causing svr_auth_pubkey() to send SSH_MSG_USERAUTH_FAILURE instead of crashing. Link: https://bugs-devel.debian.org/cgi-bin/bugreport.cgi?bug=1108342 Signed-off-by: Alexander Sverdlin <[email protected]> --- src/signkey.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/src/signkey.c b/src/signkey.c index 162752bc..f0bdcfaf 100644 --- a/src/signkey.c +++ b/src/signkey.c @@ -143,6 +143,7 @@ const char* signature_name_from_type(enum signature_type type, unsigned int *nam /* Returns DROPBEAR_SIGNATURE_NONE if none match */ enum signature_type signature_type_from_name(const char* name, unsigned int namelen) { + enum signkey_type keytype = signkey_type_from_name(name, namelen); #if DROPBEAR_RSA #if DROPBEAR_RSA_SHA256 if (namelen == strlen(SSH_SIGNATURE_RSA_SHA256) @@ -150,14 +151,16 @@ enum signature_type signature_type_from_name(const char* name, unsigned int name return DROPBEAR_SIGNATURE_RSA_SHA256; } #endif + /* keytype == DROPBEAR_SIGNKEY_RSA iff name is "ssh-rsa" (SHA1 sig algo) */ + if (keytype == DROPBEAR_SIGNKEY_RSA) { #if DROPBEAR_RSA_SHA1 - if (namelen == strlen(SSH_SIGNKEY_RSA) - && memcmp(name, SSH_SIGNKEY_RSA, namelen) == 0) { return DROPBEAR_SIGNATURE_RSA_SHA1; - } +#else + return DROPBEAR_SIGNATURE_NONE; #endif + } #endif /* DROPBEAR_RSA */ - return (enum signature_type)signkey_type_from_name(name, namelen); + return (enum signature_type)keytype; } /* Returns the signature type from a key type. Must not be called -- 2.55.0
