diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-123158.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-123158.patch new file mode 100644 index 00000000000..6fb42827a02 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-123158.patch @@ -0,0 +1,191 @@ +From 66caf6873206a863372f696083929c6cc69ea9ee Mon Sep 17 00:00:00 2001 +From: Damien Miller +Date: Thu, 5 Nov 2026 08:18:18 +1100 +Subject: [PATCH] avoid password authn bypass + +This bypass affects some configurations and runtime configurations. +We do not consider the root cause to be within OpenSSH but we are +well equipped to avoid it. + +CVE: CVE-2026-123158 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482] + +Signed-off-by: Yoann Congal +--- + auth-passwd.c | 17 +++++++++++++---- + openbsd-compat/port-uw.c | 16 ++++++++-------- + openbsd-compat/xcrypt.c | 18 +++++++++++++----- + 3 files changed, 34 insertions(+), 17 deletions(-) + +diff --git a/auth-passwd.c b/auth-passwd.c +index a9d768891..fb3b22a05 100644 +--- a/auth-passwd.c ++++ b/auth-passwd.c +@@ -50,6 +50,7 @@ + #include "ssherr.h" + #include "log.h" + #include "misc.h" ++#include "xmalloc.h" + #include "servconf.h" + #include "sshkey.h" + #include "hostfile.h" +@@ -67,6 +68,7 @@ extern login_cap_t *lc; + #define DAY (24L * 60 * 60) /* 1 day in seconds */ + #define TWO_WEEKS (2L * 7 * DAY) /* 2 weeks in seconds */ + ++#define MIN_PASSWORD_HASH_LEN 4 + #define MAX_PASSWORD_LEN 1024 + + /* +@@ -194,16 +196,20 @@ sys_auth_passwd(struct ssh *ssh, const char *password) + Authctxt *authctxt = ssh->authctxt; + struct passwd *pw = authctxt->pw; + char *encrypted_password, *salt = NULL; ++ int ret; + + /* Just use the supplied fake password if authctxt is invalid */ +- char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd; ++ char *pw_password = authctxt->valid ? ++ shadow_pw(pw) : xstrdup(pw->pw_passwd); + + if (pw_password == NULL) + return 0; + + /* Check for users with no password. */ +- if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) +- return (1); ++ if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) { ++ free(pw_password); ++ return 1; ++ } + + /* + * Encrypt the candidate password using the proper salt, or pass a +@@ -217,7 +223,10 @@ sys_auth_passwd(struct ssh *ssh, const char *password) + * Authentication is accepted if the encrypted passwords + * are identical. + */ +- return encrypted_password != NULL && ++ ret = encrypted_password != NULL && ++ strlen(pw_password) >= MIN_PASSWORD_HASH_LEN && + strcmp(encrypted_password, pw_password) == 0; ++ freezero(pw_password, strlen(pw_password)); ++ return ret; + } + #endif +diff --git a/openbsd-compat/port-uw.c b/openbsd-compat/port-uw.c +index 074f80c8d..5c50ffa0f 100644 +--- a/openbsd-compat/port-uw.c ++++ b/openbsd-compat/port-uw.c +@@ -58,14 +58,17 @@ sys_auth_passwd(struct ssh *ssh, const char *password) + int result; + + /* Just use the supplied fake password if authctxt is invalid */ +- char *pw_password = authctxt->valid ? shadow_pw(pw) : pw->pw_passwd; ++ char *pw_password = authctxt->valid ? ++ shadow_pw(pw) : xstrdup(pw->pw_passwd); + + if (pw_password == NULL) + return 0; + + /* Check for users with no password. */ +- if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) +- return (1); ++ if (strcmp(pw_password, "") == 0 && strcmp(password, "") == 0) { ++ free(pw_password); ++ return 1; ++ } + + /* Encrypt the candidate password using the proper salt. */ + salt = (pw_password[0] && pw_password[1]) ? pw_password : "xx"; +@@ -83,11 +86,8 @@ sys_auth_passwd(struct ssh *ssh, const char *password) + #endif /* UNIXWARE_LONG_PASSWORDS */ + result = (strcmp(xcrypt(password, salt), pw_password) == 0); + +-#ifdef USE_LIBIAF +- if (authctxt->valid) +- free(pw_password); +-#endif +- return(result); ++ freezero(pw_password, strlen(pw_password)); ++ return result; + } + + #ifdef UNIXWARE_LONG_PASSWORDS +diff --git a/openbsd-compat/xcrypt.c b/openbsd-compat/xcrypt.c +index 9cded6684..2721b3342 100644 +--- a/openbsd-compat/xcrypt.c ++++ b/openbsd-compat/xcrypt.c +@@ -25,6 +25,8 @@ + #include "includes.h" + + #include ++#include ++#include + #include + #include + #include +@@ -59,6 +61,8 @@ + # define crypt DES_crypt + # endif + ++#include "xmalloc.h" ++ + #define MINIMUM(a, b) (((a) < (b)) ? (a) : (b)) + + /* +@@ -71,7 +75,7 @@ static const char * + pick_salt(void) + { + struct passwd *pw; +- char *passwd, *p; ++ char *passwd = NULL, *p; + size_t typelen; + static char salt[32]; + +@@ -80,6 +84,8 @@ pick_salt(void) + strlcpy(salt, "xx", sizeof(salt)); + setpwent(); + while ((pw = getpwent()) != NULL) { ++ if (passwd != NULL) ++ freezero(passwd, strlen(passwd)); + if ((passwd = shadow_pw(pw)) == NULL) + continue; + if (passwd[0] == '$' && (p = strrchr(passwd+1, '$')) != NULL) { +@@ -90,6 +96,8 @@ pick_salt(void) + } + } + out: ++ if (passwd != NULL) ++ freezero(passwd, strlen(passwd)); + endpwent(); + return salt; + } +@@ -122,9 +130,8 @@ xcrypt(const char *password, const char *salt) + + /* + * Handle shadowed password systems in a cleaner way for portable +- * version. ++ * version. Caller must free returned value. + */ +- + char * + shadow_pw(struct passwd *pw) + { +@@ -138,7 +145,8 @@ shadow_pw(struct passwd *pw) + # endif + + #ifdef USE_LIBIAF +- return(get_iaf_password(pw)); ++ pw_password = get_iaf_password(pw); ++ return pw_password == NULL ? NULL : xstrdup(pw_password); + #endif + + # if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW) +@@ -152,5 +160,5 @@ shadow_pw(struct passwd *pw) + pw_password = spw->ufld.fd_encrypt; + # endif + +- return pw_password; ++ return pw_password == NULL ? NULL : xstrdup(pw_password); + } diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index a476645f40f..dfcb77f215d 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -34,6 +34,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-73283.patch \ file://CVE-2026-73282.patch \ file://CVE-2026-73281.patch \ + file://CVE-2026-123158.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"