CVE-2014-8132

What it actually does

Double free in ssh_packet_kexinit during key exchange handshake processing allows remote memory corruption that results in denial of service.

Why it matters to the business

Unexpected service outages and loss of availability for any systems relying on the vulnerable SSH client or library components until patches are applied.

How an attack unfolds

An unauthenticated remote attacker connects to an affected SSH endpoint and sends a specially crafted kexinit packet that triggers the double-free condition in the key exchange initialization handler.

How to fix it

Upgrade affected curl packages to the listed fixed versions: 7.47.0-1 on Debian 11/12/13 and 7.35.0-1ubuntu2.6 on Ubuntu 14.04 LTS; rebuild or replace any statically linked libssh 0.5.x/0.6.x instances with version 0.6.4 or later.

How to confirm the fix worked

Verify installed package versions against the fixed releases; confirm libssh version strings in binaries or runtime logs show 0.6.4 or newer; test connectivity with a benign kexinit exchange to ensure no crash occurs.

Typical attack path

1. Establish TCP connection to target SSH service
2. Send malicious SSH_MSG_KEXINIT packet with crafted algorithm lists
3. Trigger double free during packet processing leading to crash or instability

How to detect it

Review historical SSH daemon or client logs around the time of any unexplained crashes for malformed kexinit packets; examine core dumps or memory error logs indicating double-free conditions in kex.c.

What your security team should do

• Apply the listed package upgrades immediately on all affected Debian and Ubuntu systems
• Scan for any custom builds or embedded copies of libssh < 0.6.4 and replace them
• Monitor for availability alerts on SSH-dependent services while patches are rolled out
• Review dependency trees to identify any additional downstream packages still using vulnerable libssh