Roaming through the OpenSSH client: CVE-2016-0777 and 0778

The most interesting part of this disclosure is:

    Internal stdio buffering is the most severe of the three problems
    discussed in this section, although GNU/Linux is not affected because
    the glibc mmap()s and munmap()s (and therefore cleanses) stdio buffers.
    BSD-based systems, on the other hand, are severely affected because they
    simply malloc()ate and free() stdio buffers.

Basically the exploit reveals a big chunk of memory where, very often, your private keys happen to live. The memory has been freed, but on BSD systems the memory that was freed has not been zeroed in any way, so you still see the private keys.

Summary:

– The vulnerability allows a server you connect to to get the contents of the memory of the OpenSSH client.

– If your keys are not protected by a passphrase or you do not use ssh-agent, this can include private keys.

– OpenSSH 5.4 to 7.1 are affected.

– You can mitigate this by adding "UseRoaming no" to /etc/ssh/ssh_config or ~/.ssh/config.

– You should change your SSH keys.

On another note are there any plans to implement Roaming in the server? Because vulnerabilities aside it sounds like an awesome feature and I would use it all the time.