| Message ID | 20260903100655.2460077-1-Ghanshyam.BanaitSanjay@windriver.com |
|---|---|
| State | Superseded |
| Delegated to: | Yoann Congal |
| Headers | show |
| Series | [wrynose] libssh2: fix CVE-2026-58051 | expand |
On Thu Sep 3, 2026 at 12:06 PM CEST, Ghanshyam Banait via lists.openembedded.org wrote: > libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, > so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. > A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, > attacker-influenceable attrs pointer in a connecting libssh2 client. > > Reference: > https://nvd.nist.gov/vuln/detail/CVE-2026-58051 > > Backport the patch to fix CVE-2026-58051. > https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a > > Signed-off-by: Ghanshyam Banait <Ghanshyam.BanaitSanjay@windriver.com> > --- > .../libssh2/libssh2/CVE-2026-58051.patch | 34 +++++++++++++++++++ > .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + > 2 files changed, 35 insertions(+) > create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch Hello, There is already a pending patch for this CVE on wrynose: https://patchwork.yoctoproject.org/project/oe-core/patch/20260820055749.1378475-1-hthakar@cisco.com/ Maybe you can help reviewing it? Thanks!
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch new file mode 100644 index 0000000000..20f454a304 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch @@ -0,0 +1,34 @@ +From a9758da45a52bc8c630ec9493804d0c6ea30b24a Mon Sep 17 00:00:00 2001 +From: Viktor Szakats <vszakats@users.noreply.github.com> +Date: Mon, 29 Jun 2026 19:12:21 +0200 +Subject: [PATCH] publickey: fix potential arbitrary free in + `libssh2_publickey_list_fetch()` (#2127) + +Due to uninitialized list entry. + +Reported-and-patch-by: Behzod Abdullayev +Reported-by: Sharique Raza + +Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9 + +CVE: CVE-2026-58051 + +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a] + +Signed-off-by: Ghanshyam Banait <Ghanshyam.BanaitSanjay@windriver.com> +--- + src/publickey.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/publickey.c b/src/publickey.c +index b7f384310e..a0d3100005 100644 +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -905,6 +905,7 @@ int libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY *pkey, + goto err_exit; + } + list = newlist; ++ memset(&list[keys], 0, sizeof(list[keys])); + } + if(pkey->version == 1) { + unsigned long comment_len; diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 52684ae74e..3c72f844ad 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -21,6 +21,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2026-66034.patch \ file://CVE-2026-66035.patch \ file://CVE-2026-58050.patch \ + file://CVE-2026-58051.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client. Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-58051 Backport the patch to fix CVE-2026-58051. https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a Signed-off-by: Ghanshyam Banait <Ghanshyam.BanaitSanjay@windriver.com> --- .../libssh2/libssh2/CVE-2026-58051.patch | 34 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-58051.patch