diff mbox series

[scarthgap,1/8] openssh: Fix CVE-2026-106586

Message ID 20261105053148.2704106-1-hthakar@cisco.com
State New
Headers show
Series [scarthgap,1/8] openssh: Fix CVE-2026-106586 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 5, 2026, 5:31 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream OpenSSH 10.6p1 backport for
CVE-2026-106586. The fix is referenced in [1] and the advisory in [2].

The upstream test follow-ups in [3] and [4] update the existing
authentication-option tests for the preserved restricted flag.

[1] https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-106586
[3] https://github.com/openssh/openssh-portable/commit/ded92bffa2e2f2db9b83245c5061812791bfa47f
[4] https://github.com/openssh/openssh-portable/commit/a30bafcbbd44dc4dc91916240c32ecabff899338

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../openssh/openssh/CVE-2026-106586_p1.patch  |  38 +++++++
 .../openssh/openssh/CVE-2026-106586_p2.patch  | 100 ++++++++++++++++++
 .../openssh/openssh/CVE-2026-106586_p3.patch  |  37 +++++++
 .../openssh/openssh_9.6p1.bb                  |   3 +
 4 files changed, 178 insertions(+)
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
 create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
diff mbox series

Patch

diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
new file mode 100644
index 0000000000..398fe315cd
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch
@@ -0,0 +1,38 @@ 
+From 991f1f31dde2797416acaf4319dbebe764446c6f Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 00:33:44 +0000
+Subject: [PATCH] upstream: Propagate authorized_keys "resrict" keyword
+
+The "restrict" keyword was not pervasively being applied to TunnelForwarding
+connections (which are administratively disabled by default). This is a
+separate problem to the one fixed in openssh-10.5
+
+reported by several people; ok markus, deraadt
+
+OpenBSD-Commit-ID: 8c36c31dc2bdbc0c432d1056496b2f1ce93198d1
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f]
+
+Backport Changes:
+- Omitted the upstream OpenBSD RCS revision-only hunk and retained the
+  OpenSSH 9.6p1 revision identifier.
+
+(cherry picked from commit 991f1f31dde2797416acaf4319dbebe764446c6f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ auth-options.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/auth-options.c b/auth-options.c
+index c89b1ee..0f11269 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -606,6 +606,7 @@ sshauthopt_merge(const struct sshauthopt *primary,
+ 	OPTFLAG_AND(no_require_user_presence);
+ 	/* Restrictive flags are logical-OR (i.e. must be set in either) */
+ 	OPTFLAG_OR(require_verify);
++	OPTFLAG_OR(restricted);
+ #undef OPTFLAG_AND
+ 
+ 	/* Earliest expiry time should win */
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
new file mode 100644
index 0000000000..54478dc5a0
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch
@@ -0,0 +1,100 @@ 
+From ded92bffa2e2f2db9b83245c5061812791bfa47f Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 04:51:28 +0000
+Subject: [PATCH] upstream: correctly check sshauthopt->restricted merging
+
+OpenBSD-Regress-ID: e81e9267514338d6cf6bd2f83dcb722538af528e
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/ded92bffa2e2f2db9b83245c5061812791bfa47f]
+
+Backport Changes:
+- Omitted the upstream tests.c OpenBSD RCS revision-only hunk and
+  retained the OpenSSH 9.6p1 revision identifier.
+
+(cherry picked from commit ded92bffa2e2f2db9b83245c5061812791bfa47f)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ regress/unittests/authopt/tests.c | 41 ++++++++++++++++---------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c
+index d9e1903..f86423d 100644
+--- a/regress/unittests/authopt/tests.c
++++ b/regress/unittests/authopt/tests.c
+@@ -419,13 +419,14 @@ test_merge(void)
+ 	} while (0)
+ 
+ 	/* Check a single case of merging of flag options */
+-#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, var, val) \
++#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, \
++	    rflag, var, val) \
+ 	do { \
+ 		PREPARE(keybase " " label, keyname, keywords); \
+-		expected = mostly_off ? \
+-		    sshauthopt_new() : default_authkey_opts(); \
+-		expected->var = val; \
++		expected = rflag ? default_authkey_restrict_opts() : \
++		    (mostly_off ? sshauthopt_new() : default_authkey_opts()); \
+ 		ASSERT_PTR_NE(expected, NULL); \
++		expected->var = val; \
+ 		CHECK_SUCCESS_AND_CLEANUP(); \
+ 		TEST_DONE(); \
+ 	} while (0)
+@@ -438,40 +439,40 @@ test_merge(void)
+ #define FLAG_TEST(keybase, keyword, var) \
+ 	do { \
+ 		FLAG_CASE(keybase, "keys:default,yes cert:default,no", \
+-		    "no_" keybase, keyword, 0, var, 0); \
++		    "no_" keybase, keyword, 0, 0, var, 0); \
+ 		FLAG_CASE(keybase,"keys:-*,yes cert:default,no", \
+-		    "no_" keybase, "restrict," keyword, 1, var, 0); \
++		    "no_" keybase, "restrict," keyword, 1, 1, var, 0); \
+ 		FLAG_CASE(keybase, "keys:default,no cert:default,no", \
+-		    "no_" keybase, "no-" keyword, 0, var, 0); \
++		    "no_" keybase, "no-" keyword, 0, 0, var, 0); \
+ 		FLAG_CASE(keybase, "keys:-*,no cert:default,no", \
+-		    "no_" keybase, "restrict,no-" keyword, 1, var, 0); \
++		    "no_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
+ 		\
+ 		FLAG_CASE(keybase, "keys:default,yes cert:-*,yes", \
+-		    "only_" keybase, keyword, 1, var, 1); \
++		    "only_" keybase, keyword, 1, 0, var, 1); \
+ 		FLAG_CASE(keybase,"keys:-*,yes cert:-*,yes", \
+-		    "only_" keybase, "restrict," keyword, 1, var, 1); \
++		    "only_" keybase, "restrict," keyword, 1, 1, var, 1); \
+ 		FLAG_CASE(keybase, "keys:default,no cert:-*,yes", \
+-		    "only_" keybase, "no-" keyword, 1, var, 0); \
++		    "only_" keybase, "no-" keyword, 1, 0, var, 0); \
+ 		FLAG_CASE(keybase, "keys:-*,no cert:-*,yes", \
+-		    "only_" keybase, "restrict,no-" keyword, 1, var, 0); \
++		    "only_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \
+ 		\
+ 		FLAG_CASE(keybase, "keys:default,yes cert:-*", \
+-		    "no_permit", keyword, 1, var, 0); \
++		    "no_permit", keyword, 1, 0, var, 0); \
+ 		FLAG_CASE(keybase,"keys:-*,yes cert:-*", \
+-		    "no_permit", "restrict," keyword, 1, var, 0); \
++		    "no_permit", "restrict," keyword, 1, 1, var, 0); \
+ 		FLAG_CASE(keybase, "keys:default,no cert:-*", \
+-		    "no_permit", "no-" keyword, 1, var, 0); \
++		    "no_permit", "no-" keyword, 1, 0, var, 0); \
+ 		FLAG_CASE(keybase, "keys:-*,no cert:-*", \
+-		    "no_permit", "restrict,no-" keyword, 1, var, 0); \
++		    "no_permit", "restrict,no-" keyword, 1, 1, var, 0); \
+ 		\
+ 		FLAG_CASE(keybase, "keys:default,yes cert:*", \
+-		    "all_permit", keyword, 0, var, 1); \
++		    "all_permit", keyword, 0, 0, var, 1); \
+ 		FLAG_CASE(keybase,"keys:-*,yes cert:*", \
+-		    "all_permit", "restrict," keyword, 1, var, 1); \
++		    "all_permit", "restrict," keyword, 1, 1, var, 1); \
+ 		FLAG_CASE(keybase, "keys:default,no cert:*", \
+-		    "all_permit", "no-" keyword, 0, var, 0); \
++		    "all_permit", "no-" keyword, 0, 0, var, 0); \
+ 		FLAG_CASE(keybase, "keys:-*,no cert:*", \
+-		    "all_permit", "restrict,no-" keyword, 1, var, 0); \
++		    "all_permit", "restrict,no-" keyword, 1, 1, var, 0); \
+ 		\
+ 	} while (0)
+ 	FLAG_TEST("portfwd", "port-forwarding", permit_port_forwarding_flag);
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
new file mode 100644
index 0000000000..da8642ac24
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch
@@ -0,0 +1,37 @@ 
+From a30bafcbbd44dc4dc91916240c32ecabff899338 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 16 Sep 2026 04:56:12 +0000
+Subject: [PATCH] upstream: simpler
+
+OpenBSD-Regress-ID: c7f30b865abd0b3e0e5514f861509c32e352a760
+
+CVE: CVE-2026-106586
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a30bafcbbd44dc4dc91916240c32ecabff899338]
+
+Backport Changes:
+- Omitted the upstream tests.c OpenBSD RCS revision-only hunk and
+  retained the OpenSSH 9.6p1 revision identifier.
+
+(cherry picked from commit a30bafcbbd44dc4dc91916240c32ecabff899338)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ regress/unittests/authopt/tests.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c
+index f86423d..63f97ff 100644
+--- a/regress/unittests/authopt/tests.c
++++ b/regress/unittests/authopt/tests.c
+@@ -423,9 +423,10 @@ test_merge(void)
+ 	    rflag, var, val) \
+ 	do { \
+ 		PREPARE(keybase " " label, keyname, keywords); \
+-		expected = rflag ? default_authkey_restrict_opts() : \
+-		    (mostly_off ? sshauthopt_new() : default_authkey_opts()); \
++		expected = mostly_off ? \
++		    sshauthopt_new() : default_authkey_opts(); \
+ 		ASSERT_PTR_NE(expected, NULL); \
++		expected->restricted = rflag; \
+ 		expected->var = val; \
+ 		CHECK_SUCCESS_AND_CLEANUP(); \
+ 		TEST_DONE(); \
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 04595e706f..4266f05dd4 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -44,6 +44,9 @@  SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
            file://CVE-2026-60001.patch \
            file://CVE-2026-60002.patch \
            file://CVE-2026-60000.patch \
+           file://CVE-2026-106586_p1.patch \
+           file://CVE-2026-106586_p2.patch \
+           file://CVE-2026-106586_p3.patch \
            file://CVE-2026-73283.patch \
            file://CVE-2026-73282.patch \
            file://CVE-2026-73281.patch \