diff mbox series

[wrynose,09/10] openssh: Fix CVE-2026-106552

Message ID 20261016035236.442896-10-hthakar@cisco.com
State New
Headers show
Series openssh: Security fixes | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 16, 2026, 3:52 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/openssh/openssh-portable/commit/c07ea2180adebd6019a6ebdd89becb9d9f4b4897
[2] https://ubuntu.com/security/CVE-2026-106552

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../openssh/openssh/CVE-2026-106552.patch     | 63 +++++++++++++++++++
 .../openssh/openssh_10.3p1.bb                 |  1 +
 2 files changed, 64 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch
new file mode 100644
index 0000000000..a44d70a24f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch
@@ -0,0 +1,63 @@ 
+From c07ea2180adebd6019a6ebdd89becb9d9f4b4897 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Thu, 1 Oct 2026 03:11:49 +0000
+Subject: [PATCH] upstream: sftp: be stricter in accepting paths returned by the
+
+server for SSH_FXP_REALPATH or SSH2_FXP_READDIR replies, as these can be used
+in some situations to decide the destination path for recursive transfers.
+
+Report and patch from Junghoon Cho
+
+OpenBSD-Commit-ID: ad357002a1b75c87113f01086a9f0c12c36082d8
+
+CVE: CVE-2026-106552
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/c07ea2180adebd6019a6ebdd89becb9d9f4b4897]
+
+Backport Changes:
+- Omitted upstream OpenBSD revision-only hunks and retained the Wrynose
+  OpenSSH 10.3p1 context.
+
+(cherry picked from commit c07ea2180adebd6019a6ebdd89becb9d9f4b4897)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ sftp-client.c |  3 ++-
+ sftp.c        | 12 +++++++++---
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git a/sftp-client.c b/sftp-client.c
+--- a/sftp-client.c
++++ b/sftp-client.c
+@@ -785,7 +785,8 @@ sftp_lsreaddir(struct sftp_conn *conn, const char *path,
+ 			 * These can be used to attack recursive ops
+ 			 * (e.g. send '../../../../etc/passwd')
+ 			 */
+-			if (strpbrk(filename, SFTP_DIRECTORY_CHARS) != NULL) {
++			if (*filename == '\0' ||
++			    strpbrk(filename, SFTP_DIRECTORY_CHARS) != NULL) {
+ 				error("Server sent suspect path \"%s\" "
+ 				    "during readdir of \"%s\"", filename, path);
+ 			} else if (dir) {
+diff --git a/sftp.c b/sftp.c
+--- a/sftp.c
++++ b/sftp.c
+@@ -676,9 +676,15 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst,
+ 			goto out;
+ 		}
+ 
+-		/* Special handling for dest of '..' */
+-		if (strcmp(filename, "..") == 0)
+-			filename = "."; /* Download to dest, not dest/.. */
++		/*
++		 * Special handling for destinations of '..' and remote roots.
++		 * In particular, never select the local root as an implicit
++		 * destination for a remote root.
++		 */
++		if (strcmp(filename, "..") == 0 ||
++		    (filename[0] != '\0' &&
++		    filename[strspn(filename, "/")] == '\0'))
++			filename = ".";
+ 
+ 		if (g.gl_matchc == 1 && dst) {
+ 			if (local_is_dir(dst)) {
+-- 
+2.43.0
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 4d9fd0c164..a2a5a3b924 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -42,6 +42,7 @@  SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
            file://CVE-2026-106582.patch \
            file://CVE-2026-106585.patch \
            file://CVE-2026-106583.patch \
+           file://CVE-2026-106552.patch \
            "
 SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"