[Go 1.23.0] CVE-2026-39830: ssh: fix deadlock on unexpected channel responses - #20
Open
Atharva-Shinde wants to merge 2 commits into
Open
Conversation
Previously, the mux implementation handled global request responses by blocking until the response could be sent to the globalResponses channel. Since this channel has a buffer size of 1, unsolicited responses from a server (or responses arriving after a timeout) would fill the buffer. Subsequent unsolicited responses would block handleGlobalPacket, stalling the entire connection's read loop and causing a denial of service. This change modifies handleGlobalPacket to use a non-blocking send. If no goroutine is waiting for a response (or the buffer is full), the message is dropped. This aligns with OpenSSH behavior, which ignores unexpected global responses. Additionally, SendRequest now drains the globalResponses channel after acquiring the mutex but before sending the request. This ensures that any stale responses or "spam" buffered just before the lock was acquired are discarded, preventing race conditions where a legitimate request might otherwise consume an unrelated response. This issue was found during a security audit by NCC Group Cryptography Services, sponsored by Teleport. Fixes golang/go#79564 Fixes CVE-2026-39830 Change-Id: Ia0c46355203d557eadcd432c10b87c8a044e1089 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781640 Reviewed-by: Roland Shoemaker <roland@golang.org> Reviewed-by: Neal Patel <nealpatel@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Previously, channel.handlePacket sent channelRequestSuccess and channelRequestFailure messages to ch.msg unconditionally via the default arm of its type switch. Because ch.msg is a bounded buffer (chanSize), a peer that sends a burst of unsolicited channel request responses for an open, idle channel fills the buffer and blocks the mux read loop on the next send. That stalls all packet processing on the connection, and because readLoop then backs up on t.incoming, closing the underlying net.Conn does not unblock either goroutine: user code observes Close() returning promptly while Wait() hangs and the mux, readLoop, and kexLoop goroutines leak permanently. This change mirrors the fix for the mux-level SendRequest path: a sentRequestPending atomic gate is set while a SendRequest with WantReply is in flight, handlePacket drops responses when the gate is closed, and uses a non-blocking send otherwise. SendRequest drains any spurious response that slipped through before discarding it, so the caller always observes the reply to its own request. This aligns with OpenSSH, which silently ignores channel confirm messages that do not match a pending request. Fixes golang/go#79564 Fixes CVE-2026-39830 Change-Id: I15e2add4bf7876bb0c6f921f8b57203d97e83f47 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/781664 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Neal Patel <nealpatel@google.com> Reviewed-by: Neal Patel <nealpatel@google.com> Reviewed-by: Roland Shoemaker <roland@golang.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Process
Conflicts
No conflicts — patches applied cleanly.
Patch Source
v0.41.0-GO-2026-5017-0.patch
v0.41.0-GO-2026-5017-1.patch
Verification
Unit tests output