CVE-2026-102822

Executive Summary

CVE-2026-102822 is a denial-of-service (DoS) vulnerability in the Russh Rust SSH client and server library, affecting versions prior to 0.63.1. A remote peer can exploit a flaw in MAC negotiation logic when a connection is configured to permit mac=none, causing a panic that terminates the connection task. The impact is limited to availability (CVSS 3.7, Low), with no confidentiality or integrity impact, and exploitation requires specific non-default configuration (permissive MAC settings).

Technical Analysis

Russh is a Rust implementation of the SSH protocol, used both as a client and server library. The vulnerability resides in the negotiation of Message Authentication Codes (MACs). When a connection is configured to allow mac=none, the selection logic incorrectly permits negotiation of a MAC-requiring CTR or CBC block cipher. This occurs because the needs_mac() validation is only performed when MAC selection fails—not when a MAC-requiring cipher is selected in conjunction with mac=none.

Once such a connection is established, a remote peer (acting as the SSH server or client, depending on deployment) can send a packet with a decrypted length of zero. In russh/src/cipher/mod.rs, the code attempts to shrink a previously read block based on this zero length and then indexes into buffer.buffer[16..]. This out-of-bounds indexing (CWE-129: Improper Validation of Array Index) triggers a panic, which terminates the connection task. The panic is not a memory-safety violation but a logic error leading to an unrecoverable runtime exception.

The attack surface is any SSH endpoint (client or server) using the affected Russh library and configured with mac=none as an allowed option. This is a non-default configuration; standard deployments typically enforce MAC algorithms. The vulnerability requires network access to the SSH port and the ability to negotiate the specific cipher/MAC combination.

Exploitation Scenarios

1. Reconnaissance/Target Identification: An attacker identifies a service or client using Russh by banner grabbing (SSH identification string often reveals "Russh" or related library metadata) or by probing for supported algorithms during SSH handshake (e.g., via ssh -Q mac against a Russh-based server if it exposes algorithm lists). The attacker must determine whether mac=none is permitted; this may be inferred from negotiation responses.

2. Triggering the Flaw: The attacker initiates an SSH connection and, during algorithm negotiation, selects a CTR or CBC block cipher while specifying mac=none. Due to the logic flaw, the server (or client) accepts this combination despite the cipher requiring a MAC. The attacker then sends a crafted SSH packet with a decrypted length field of zero. The vulnerable code path in russh/src/cipher/mod.rs processes this packet, attempts to shrink the read block, and indexes buffer.buffer[16..], causing a panic.

3. Payload/Execution: No shellcode or payload is required beyond the malformed packet. The attack is a single crafted packet after negotiation. The panic terminates the connection task, which may crash the entire process if the task is not isolated (e.g., in a single-threaded server or if panic=abort is set). In multi-threaded async runtimes (e.g., Tokio), the panic may only kill the connection task, but repeated attempts can exhaust resources or cause service degradation.

4. Post-Exploitation Impact: The primary impact is denial of service for the affected connection. If the Russh instance is part of a critical SSH server or client, an attacker can repeatedly trigger panics to disrupt availability. No lateral movement, data exfiltration, or privilege escalation is possible via this vulnerability alone. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a high attack complexity due to the required non-default configuration and precise packet crafting.

Impact Assessment

The vulnerability affects Russh-based SSH servers and clients configured to allow mac=none. This configuration is uncommon in production environments but may be present in embedded systems, testing frameworks, or legacy integrations where MAC algorithms are disabled for performance or compatibility. The blast radius is limited to the specific SSH service or client instance; however, if the Russh library is used in a multi-tenant service, a single attacker could cause repeated panics, leading to service unavailability. The CVSS score of 3.7 (Low) reflects the high attack complexity (AC:H) and the limited availability impact (A:L). There is no impact on confidentiality (C:N) or integrity (I:N). Business impact includes potential downtime for SSH-dependent automation, remote administration, or file transfer operations. Organizations relying on Russh for critical infrastructure should prioritize patching despite the low severity, as DoS can cascade in orchestrated environments.

Detection Guidance

Sigma Rule

title: Russh SSH MAC Negotiation DoS Attempt
id: 8f4b3c2a-1d5e-4f7a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects SSH connections negotiating mac=none with a CTR or CBC cipher, potentially exploiting CVE-2026-102822.
author: Threat Intelligence
date: 2026-05-12
logsource:
  product: linux
  service: sshd
detection:
  selection_negotiation:
    - 'MAC: none'
    - 'cipher: aes*-ctr'
    - 'cipher: aes*-cbc'
  condition: selection_negotiation
falsepositives:
  - Legitimate use of mac=none in test environments
level: low
tags:
  - attack.t1190
  - cve.2026-102822

YARA Rule

rule CVE_2026_102822_Russh_DoS
{
    meta:
        description = "Detects Russh library versions vulnerable to CVE-2026-102822"
        author = "Threat Intelligence"
        date = "2026-05-12"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102822"
        hash = "unknown"
    strings:
        $s1 = "russh" ascii wide nocase
        $s2 = "needs_mac" ascii wide
        $s3 = "buffer.buffer[16..]" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 22 (msg:"CVE-2026-102822 Russh SSH MAC Negotiation DoS Attempt"; flow:to_server,established; content:"SSH-2.0-"; depth:8; content:"none"; nocase; content:"aes"; nocase; content:"ctr"; nocase; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where network.transport == "tcp" and destination.port == 22 and event.action == "connection_attempted"]
  [network where network.transport == "tcp" and destination.port == 22 and network.protocol == "ssh" and process.name == "sshd" and message contains "mac=none"]

Splunk SPL Query

index=linux sourcetype=syslog OR sourcetype=sshd
| search "mac=none" OR "MAC: none"
| rex field=_raw "cipher=(?<cipher>\S+)"
| where cipher IN ("aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-cbc", "aes192-cbc", "aes256-cbc")
| stats count by src_ip, dest_ip, cipher
| where count > 5

Wazuh OSSEC Rule

<group name="ssh,">
  <rule id="100001" level="5">
    <decoded_as>sshd</decoded_as>
    <match>mac=none</match>
    <description>CVE-2026-102822: Possible Russh SSH MAC negotiation DoS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Disable mac=none in all Russh configurations unless absolutely necessary. Enforce strict MAC algorithm lists (e.g., hmac-sha2-256, hmac-sha2-512).
   • If mac=none must be allowed, ensure that it is never combined with CTR or CBC ciphers by explicitly restricting cipher suites to those that do not require a MAC (e.g., AEAD ciphers like aes256-gcm).
   • Monitor SSH logs for negotiation attempts involving mac=none and CTR/CBC ciphers.
   • Implement network-level rate limiting or connection throttling on SSH ports to reduce the impact of repeated panic-triggering attempts.

2. Patch/Upgrade Steps:

   • Upgrade Russh to version 0.63.1 or later, which contains the fix for this issue. The patch corrects the selection logic to validate needs_mac() whenever a MAC-requiring cipher is selected, even if MAC selection succeeds with none.
   • Verify the upgrade by checking the library version in Cargo.toml or Cargo.lock and rebuilding dependent applications.

3. Long-term Hardening:

   • Adopt a policy of least functionality: never allow mac=none in production SSH configurations.
   • Use AEAD ciphers (e.g., AES-GCM, ChaCha20-Poly1305) that integrate encryption and authentication, eliminating the need for separate MAC negotiation.
   • Regularly audit SSH algorithm configurations against security benchmarks (e.g., Mozilla SSH guidelines).
   • Implement robust exception handling around connection tasks to prevent a single panic from terminating the entire service. Use panic = "unwind" in Rust and catch panics at the task boundary.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-102822
• Russh GitHub Repository: https://github.com/Eugeny/russh
• Russh Release Notes (0.63.1): https://github.com/Eugeny/russh/releases/tag/v0.63.1
• CWE-129: Improper Validation of Array Index: https://cwe.mitre.org/data/definitions/129.html
• No known threat actor campaigns or exploit-in-the-wild evidence at this time.