libssh ChaCha20 Cipher Heap Exhaustion Vulnerability with OpenSSL

A vulnerability exists in libssh when the ChaCha20 cipher is used with the OpenSSL library. The issue arises if an attacker exhausts the heap space, leading to libssh potentially using a cipher context that is only partially initialized. This problem occurs because the OpenSSL error code indicating a failure is misinterpreted as a success, causing libssh to overlook the error. As a result, this vulnerability can lead to undefined behavior, such as compromising data confidentiality and integrity or causing crashes.

Impact

Exploitation of this vulnerability can result in undefined behavior, including crashes or compromised data confidentiality and integrity.