diff mbox series

[meta-oe,scarthgap] libssh: Fix CVE-2025-5318

Message ID 20250710143737.49615-1-ravineet.a.singh@est.tech
State New
Headers show
Series [meta-oe,scarthgap] libssh: Fix CVE-2025-5318 | expand

Commit Message

Ravineet Singh July 10, 2025, 2:37 p.m. UTC 
Fixes a likely read beyond bounds in sftp server handle
Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-5318

Upstream patch: https://git.libssh.org/projects/libssh.git/commit/?id=ae8881dfe54214c0c0eb88345c35e15a14081b3d

Signed-off-by: Ravineet Singh <ravineet.a.singh@est.tech>
---
 ...tpserver-Fix-possible-buffer-overrun.patch | 31 +++++++++++++++++++
 .../recipes-support/libssh/libssh_0.10.6.bb   |  1 +
 2 files changed, 32 insertions(+)
 create mode 100644 meta-oe/recipes-support/libssh/libssh/0001-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-support/libssh/libssh/0001-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch b/meta-oe/recipes-support/libssh/libssh/0001-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
new file mode 100644
index 0000000000..de9a43b944
--- /dev/null
+++ b/meta-oe/recipes-support/libssh/libssh/0001-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch
@@ -0,0 +1,31 @@ 
+From aa1131c9b16478630d41c1e067744b83474b1886 Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Tue, 22 Apr 2025 21:18:44 +0200
+Subject: [PATCH] CVE-2025-5318: sftpserver: Fix possible buffer overrun
+
+CVE: CVE-2025-5318
+Upstream-Status: Backport https://git.libssh.org/projects/libssh.git/commit/?id=ae8881dfe54214c0c0eb88345c35e15a14081b3d
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
+Signed-off-by: Ravineet Singh <ravineet.a.singh@est.tech>
+---
+ src/sftpserver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/sftpserver.c b/src/sftpserver.c
+index 9117f155..b3349e16 100644
+--- a/src/sftpserver.c
++++ b/src/sftpserver.c
+@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){
+ 
+   memcpy(&val, ssh_string_data(handle), sizeof(uint32_t));
+ 
+-  if (val > SFTP_HANDLES) {
++  if (val >= SFTP_HANDLES) {
+     return NULL;
+   }
+ 
+-- 
+2.43.0
+
diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
index 31f29c1b7d..454c7b6f35 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb
@@ -9,6 +9,7 @@  DEPENDS = "zlib openssl"
 SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable-0.10 \
            file://0001-tests-CMakeLists.txt-do-not-search-ssh-sshd-commands.patch \
            file://0001-libgcrypt.c-Fix-prototype-of-des3_encrypt-des3_decry.patch \
+           file://0001-CVE-2025-5318-sftpserver-Fix-possible-buffer-overrun.patch \
            file://run-ptest \
           "
 SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"