CVE-2025-58181
📋 TL;DR
This vulnerability in SSH servers allows attackers to cause denial of service through memory exhaustion by sending malformed GSSAPI authentication requests. It affects SSH servers using GSSAPI authentication, particularly those built with vulnerable versions of Go's crypto/ssh package. Systems with GSSAPI enabled for SSH authentication are at risk.
💻 Affected Systems
- Go crypto/ssh package
- Applications using Go's crypto/ssh with GSSAPI support
📦 What is this software?
Crypto by Golang
⚠️ Risk & Real-World Impact
Worst Case
Complete SSH service disruption due to memory exhaustion, preventing legitimate authentication and potentially affecting system stability.
Likely Case
SSH service degradation or temporary unavailability requiring service restart, impacting remote administration capabilities.
If Mitigated
Minimal impact if GSSAPI authentication is disabled or proper resource limits are configured.
🎯 Exploit Status
Exploitation requires sending specially crafted SSH packets to trigger the memory allocation issue. No authentication is required to send the malformed request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Go 1.23.3 and Go 1.22.12
Vendor Advisory: https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
Restart Required: Yes
Instructions:
1. Update Go to version 1.23.3 or 1.22.12. 2. Rebuild any applications using crypto/ssh package. 3. Restart SSH services using the updated applications.
🔧 Temporary Workarounds
Disable GSSAPI authentication
allDisable GSSAPI authentication in SSH server configuration to prevent exploitation
In sshd_config: set 'GSSAPIAuthentication no'
🧯 If You Can't Patch
- Disable GSSAPI authentication in SSH configuration
- Implement network controls to limit SSH access to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Check if SSH server uses Go crypto/ssh package and has GSSAPI authentication enabled. Review sshd_config for 'GSSAPIAuthentication yes'.Check Version:
go versionVerify Fix Applied:
Verify Go version is 1.23.3 or 1.22.12, and SSH services have been restarted after update.📡 Detection & Monitoring
Log Indicators:
- Multiple failed GSSAPI authentication attempts
- SSH service crashes or restarts
- High memory usage by SSH processes
Network Indicators:
- Unusual volume of SSH connection attempts with GSSAPI negotiation
- Malformed SSH packets targeting port 22
SIEM Query:
source="sshd" AND ("GSSAPI" OR "authentication failure") | stats count by src_ip