CVE-2023-3603
Processing sftp server read may cause null dereference
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
A missing allocation check in sftp server processing read requests may cause a NULL dereference on low-memory conditions. The malicious client can request up to 4GB SFTP reads, causing allocation of up to 4GB buffers, which was not being checked for failure. This will likely crash the authenticated user's sftp server connection (if implemented as forking as recommended). For thread-based servers, this might also cause DoS for legitimate users. Given this code is not in any released versions, no security releases have been issued.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | Low3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.90% · top 40% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.1.
Weakness
Affected products
libssh
All versions: affected
Red Hat · Red Hat Enterprise Linux 7
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 8
All versions: unaffected
Red Hat · Red Hat Enterprise Linux 9
All versions: unaffected
Fedora · Extra Packages for Enterprise Linux 7
All versions: unaffected
All versions: unaffected
What to do
Workaround: The SFTP server implementation is based on callbacks so you can rewrite the sftp_channel_default_data_callback() to provide additional checks. [1] https://gitlab.com/libssh/libssh-mirror/-/blob/master/examples/sample_sftpserver.c#L330
References (2)
- https://access.redhat.com/security/cve/CVE-2023-3603 (opens in a new tab)vdb-entryx_refsource_REDHATx_transferred
- RHBZ#2221791 (opens in a new tab)issue-trackingx_refsource_REDHATx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-3603)Record last updated .