1. Vulnerability description
OpenSSH (OpenBSD Secure Shell) is a set of connection tools for securely accessing remote computers maintained by the OpenBSD project team. This tool is an open source implementation of the SSH protocol, which supports encryption of all transmissions, which can effectively prevent eavesdropping, connection hijacking and other network-level attacks. The kex_input_kexinit() function of the kex.c file in OpenSSH 6.x and 7.x to 7.3 has a memory exhaustion problem, resulting in a denial of service vulnerability. A remote attacker/unauthenticated client can exploit this vulnerability by sending many repeated KEXINIT requests , increasing the memory allocation per connection on the server to 384MB, exhausting the server's memory, and causing a denial of service attack. Note: 3rd party reports do not consider OpenSSH upstream to be a security vulnerability.
Affected products: OpenSSH 6.8-7.3
Hazard Level: High Danger
CVE ID: CVE-2016-8858
CNCVE ID: CNCVE-20168858
National Vulnerability Database ID: CNNVD-201610-679
CNVD ID: CNVD-2016-09674
For more information: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8858
2. Restoration
The official recommends that users upgrade the source code