diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch new file mode 100644 index 0000000000..b27d31d3c9 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch @@ -0,0 +1,100 @@ +From 670510d1e190b0f4e47066f24498c04ada1da0f0 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:37:07 +0000 +Subject: [PATCH] upstream: Reset GSSAPI client state before authentication + +Avoids situation where a partially-completed GSSAPI authentication attempt +can retain state that is subsequently used by a later attempt. + +Report and feedback Moritz Theile, also reported by several others. + +ok markus, deraadt + +OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556 + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0] + +Backport Changes: +- Omit upstream OpenBSD revision-only hunks. + +(cherry picked from commit 670510d1e190b0f4e47066f24498c04ada1da0f0) +Signed-off-by: Hetvi Thakar +--- + auth2.c | 1 + + gss-serv.c | 19 ++++++++++++------- + monitor.c | 2 ++ + ssh-gss.h | 1 + + 4 files changed, 16 insertions(+), 7 deletions(-) + +diff --git a/auth2.c b/auth2.c +--- a/auth2.c ++++ b/auth2.c +@@ -338,3 +338,4 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh) + #ifdef GSSAPI ++ ssh_gssapi_cleanup_global_client(); + /* XXX move to auth2_gssapi_stop() */ + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -361,12 +361,21 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) + } + } + ++void ++ssh_gssapi_cleanup_global_client() ++{ ++ OM_uint32 lmin; ++ ++ gss_release_buffer(&lmin, &gssapi_client.displayname); ++ gss_release_buffer(&lmin, &gssapi_client.exportedname); ++ gss_release_cred(&lmin, &gssapi_client.creds); ++ explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client)); ++} ++ + /* Privileged */ + int + ssh_gssapi_userok(char *user) + { +- OM_uint32 lmin; +- + if (gssapi_client.exportedname.length == 0 || + gssapi_client.exportedname.value == NULL) { + debug("No suitable client data"); +@@ -377,11 +386,7 @@ ssh_gssapi_userok(char *user) + return 1; + else { + /* Destroy delegated credentials if userok fails */ +- gss_release_buffer(&lmin, &gssapi_client.displayname); +- gss_release_buffer(&lmin, &gssapi_client.exportedname); +- gss_release_cred(&lmin, &gssapi_client.creds); +- explicit_bzero(&gssapi_client, +- sizeof(ssh_gssapi_client)); ++ ssh_gssapi_cleanup_global_client(); + return 0; + } + else +diff --git a/monitor.c b/monitor.c +--- a/monitor.c ++++ b/monitor.c +@@ -1990,6 +1990,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m) + if (!options.gss_authentication) + fatal_f("GSSAPI authentication not enabled"); + ++ ssh_gssapi_cleanup_global_client(); ++ + if ((r = sshbuf_get_string(m, &p, &len)) != 0) + fatal_fr(r, "parse"); + goid.elements = p; +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -132,4 +132,5 @@ void ssh_gssapi_cleanup_creds(void); + void ssh_gssapi_storecreds(void); + const char *ssh_gssapi_displayname(void); ++void ssh_gssapi_cleanup_global_client(); + + #endif /* GSSAPI */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch new file mode 100644 index 0000000000..02b7d7661a --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch @@ -0,0 +1,80 @@ +From 6f9cd19af05aa828d7778cfb047faaed1679e8b7 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:37:52 +0000 +Subject: [PATCH] upstream: Only store GSSAPI creds when authn succeeds + +Issue report and patch from Moritz Theile + +ok markus, deraadt + +OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467 + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7] + +Backport Changes: +- Omit upstream OpenBSD revision-only hunks. + +(cherry picked from commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7) +Signed-off-by: Hetvi Thakar +--- + gss-serv.c | 13 ++++++++++--- + ssh-gss.h | 1 + + 2 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -52,7 +52,7 @@ extern ServerOptions options; + + static ssh_gssapi_client gssapi_client = + { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, +- GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}}; ++ GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0}; + + ssh_gssapi_mech gssapi_null_mech = + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; +@@ -281,6 +281,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) + + gss_buffer_desc ename; + ++ client->userok = 0; + client->mech = NULL; + + while (supported_mechs[i]->name != NULL) { +@@ -332,4 +333,9 @@ ssh_gssapi_storecreds(void) + { ++ if (!gssapi_client.userok) { ++ debug_f("GSSAPI client was not authorized, doing nothing"); ++ return; ++ } ++ + if (options.gss_deleg_creds == 0) { + debug_f("delegate credential is disabled, doing nothing"); + return; +@@ -382,9 +388,10 @@ ssh_gssapi_userok(char *user) + } + if (gssapi_client.mech && gssapi_client.mech->userok) +- if ((*gssapi_client.mech->userok)(&gssapi_client, user)) ++ if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { ++ gssapi_client.userok = 1; + return 1; +- else { ++ } else { + /* Destroy delegated credentials if userok fails */ + ssh_gssapi_cleanup_global_client(); + return 0; + } +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -72,6 +72,7 @@ typedef struct { + gss_cred_id_t creds; + struct ssh_gssapi_mech_struct *mech; + ssh_gssapi_ccache store; ++ int userok; + } ssh_gssapi_client; + + typedef struct ssh_gssapi_mech_struct { +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch new file mode 100644 index 0000000000..0d40de214b --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch @@ -0,0 +1,42 @@ +From d549f99da344c178c5f632a62a6aa60544d7236e Mon Sep 17 00:00:00 2001 +From: "robert@openbsd.org" +Subject: [PATCH] upstream: ssh_gssapi_cleanup_global_client() needs a prototype + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d549f99da344c178c5f632a62a6aa60544d7236e] + +Backport Changes: +- Retain the Wrynose 10.3p1 context and omit upstream OpenBSD revision-only + hunks. + +(cherry picked from commit d549f99da344c178c5f632a62a6aa60544d7236e) +Signed-off-by: Hetvi Thakar +--- + gss-serv.c | 2 +- + ssh-gss.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -368,7 +368,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) + } + + void +-ssh_gssapi_cleanup_global_client() ++ssh_gssapi_cleanup_global_client(void) + { + OM_uint32 lmin; + +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -133,5 +133,5 @@ void ssh_gssapi_cleanup_creds(void); + void ssh_gssapi_storecreds(void); + const char *ssh_gssapi_displayname(void); +-void ssh_gssapi_cleanup_global_client(); ++void ssh_gssapi_cleanup_global_client(void); + + #endif /* GSSAPI */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index a2a5a3b924..925b22e129 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -43,6 +43,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106585.patch \ file://CVE-2026-106583.patch \ file://CVE-2026-106552.patch \ + file://CVE-2026-106553_CVE-2026-106555_p1.patch \ + file://CVE-2026-106553_CVE-2026-106555_p2.patch \ + file://CVE-2026-106553_CVE-2026-106555_p3.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"