From patchwork Mon Aug 3 08:22:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94279 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B7FFC5518F for ; Mon, 3 Aug 2026 08:22:58 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.38773.1785745374729649145 for ; Mon, 03 Aug 2026 01:22:55 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=tAiflPJa; spf=pass (domain: est.tech, ip: 52.101.66.49, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Q7sbSudA5OaOb1uUHA25Yl/1dX3fFLjnI8VzM9Hl3j99J6eZyy8ZnaWh+mjoKPklpeiHMKPPg4LHZyQUTwOqBi7nkIzTKS+LJ4ocaIj+kSuOecjHECbpxg9RSBVh7M9WCwai510Id2OmiE4iRLZRdXPZtB+GhxIPggw+RIv1MXm8RLqZy2VY+iE1/OrOAGpPcirrnQtIRh5qpjfHZz8dSde+xzr5QAXCWiyQLm8Qx8GQs6mmEobreS7oHNc0TMKn/eCwHRgGJ9iuBWpVoA4dUNrP+6LEBvkBhuqXsyCjPu7JSPKxznMNNOosLFYCP/aQS7zvS8vuZr8QT/sJE5wbJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1cjB8YeuGyqrImUZCiO0X7OE1M65Ty+fS5tyQpjQcj4=; b=YAgPUlkEZXCndBd2lHMWgh09gQHP4imYA7XWlSNmSG1cbm0G9z6m8T6Yhk4h0lXb+fhQoNrQsBQmLGadHwTxV1W7ofGVwxs+OloJWBk1Z4dQl0VvIsaU3bYrAX9c9cEDQztRhHG5kheCTSR5UWYNk45VDvbuQ5X37CEL8iuLrH+akeQZ523Cf7yAzPBK90pI/6ZGqKHH4U5fNWrPLVa+47X+sGK963SfVIRsaEp2pr08wmlI6v39WWjKJ5mSSCOMIDw34K45Zj0Bpv1kAWHVPgUwN9+eXl8BxsoaEO24cBXIeZvqyW5y6cFeavX8Va7OxMNqZn5K505E6KjG1sFbcw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1cjB8YeuGyqrImUZCiO0X7OE1M65Ty+fS5tyQpjQcj4=; b=tAiflPJagPr23wtAGrwdg3jdrlqItruIRsbLS+guKOlmYZXgmx8k/dhdfg5XYKVirCJgmQgypZlq6bnVJGTTb64oEL90WEyUM4G03l7GX7Ok0oHQWIzUhQQCRHUW1vSGaiHl4blSOUuzcCDe70yhKD9IFEsi62WAqc//OdaWHh7LC3nvqGAtsW/Pexf+83r+WnWlF2RJC39QYOQYfKuY7DzT9YHMkjtc5+bDWJG3fmwaUXO42OiM60ut59e+0QOcMFapIj6BEKuu4ezC8n80bwbMm6jYYkVXtgCIaniKP67Wp7c/T4nfiac5lFczUVWaireNbdonoO/7HbDNKUBCUg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV1P189MB3098.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:25f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 08:22:53 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 08:22:53 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [PATCH 1/3] libssh2: fix CVE-2026-66033 Date: Mon, 3 Aug 2026 10:22:40 +0200 Message-ID: <20260803082242.44009-2-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260803082242.44009-1-jaipaul.cheernam@est.tech> References: <20260803082242.44009-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DU7P251CA0008.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:551::21) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV1P189MB3098:EE_ X-MS-Office365-Filtering-Correlation-Id: 97565d9a-9a88-4318-5023-08def1386a21 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|10067099003|56012099006|11063799006|12006099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: PPUzH7z4oO+PUxazj0DoR9f9uV+FaFkrpijGaDXMP9zVJsdsePxOh08cXptSM1/d9ldupfB0RoHzhkbeaYN2vS5yblEccp+SdSeyzPVbr/WtJEBb4/ajAO0KBpp0Qv+rb1bpqCD8ob99JayjhPKIk4WMLE+ET9K0VYQSW9rLQW3gslzUCMbK6QXjSmJLl1RcbXHioKvZ5FppBJIdXfKTAQYxUySSiHdWedfKXwm1YNTXF9cw1Pn7SeWHeuH5IcL1sobTDbWMYS5LZwDN4LfPmKoEY3derld30Mu41e3AkBV8kRQMQM1GVA+SbC/XTQEx3zyCbbUIFgQMYB2D0wmWaiKvPOmyKNrPMofivEX/hZ49GL+AzqMKF5w70lc7HvwEyLomD9xb+qI4J9ANrAGq3x07iFihu2JfKWr5/t36HmtKi0InQa25Lv+lJ/zipHOxz9+6ZDtEtY3ghRGrgB141JAIWcLb/tAWIJNHdOC+M2aijwPQkWNkKlL0uNNV+oYBiLi9DR0ZKnqYia9fFs7sUroMr3dvc4Xy+i6nR716bTL4I62xBOqQP9mlbkiqvXI5OVRkq8oWw+ZRa0QUNiSn3jowLahCncuETfm2QFh5+RmBje3PAy+ooybK1E/m+Fe6xrIduNrgEzZ2oaSCqHTpWWyy6g5ie7ju/d8XOLQgFlM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(10067099003)(56012099006)(11063799006)(12006099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: 6QOnOQ9qP/j9890DaJ8+8XgLDnlZ0XtEaQHboEuOSRMlwAn48ED6L4YMl4uoDdJ0LWWIdsA+NfCVvyJtS4pXhBosay18Ah3M2QseUWrI8mx+arGz7qfv0QI9t1LKBv0G8JiOgfEHRkz1NhsksQbahAG5+ZEzpqG5dApUWSMH6iCYAMPkZZy4QwrDnKR+u1KYT12Ccp+y9o4fSC0t1oeB+hrJZDOOa8QYPk9ZL5ald2PJT4FyZua0y+LKu2C8UX4/4WAaKfwbZIsohEnnicfE0NgiSFVXZXQfdL+hT6oixaYObUwuJdtIZiNLFrswfF6yxFXX8cJTSw4Tw4Eci/PP2GMEErm7Bf1am5psYG2cq3hzreciHyA+O/26pqyy+fYNCM5ZUFy/1XiHKA4FULkVouktDFCMEEYtuxSy6lhk20iQPWS/t/mh1vgkKXTOZThALk8Sibr5HIgcVkfaC/MCx+uhwRO+dJYgGUPs/DMO7pnLDZrIRxwZ2Z4pRIdsEgU2Wn/dkT9bEHQ007M/0tI1ZzAw3v7yf6vCcdubA/aXznUSd/SM4eUD18Xohofhj9hQsjIf2aS2BS7e6sVYavRrwexlMDlUfi+LCEcZM8eW7Ww4muAtV02EUohIlFqDcqvKmHgD95YOShkn97tbvigYnSNXkrimTR+6nCW61Jmb70In3JJICm0hK+mcGtG+UKkmC6X8fWNftAAfjtaA1tiYNS3BlsghbOw7zDu2O/0F5a3rOR6Lbzztj3x1g7KAUW8DZGQno0O7gkEmogOBBS4gT+6/s1hxmtkSa3vhRsDS5DWk2cs/afzWN0OTPIeu4Ob8gAPX317eJ5oVbmppLDYvhKR+QkWBqNmqh0BlJVVE4YyytO/La9fq+NOFeYykT3fNrZPWEUOHZAN2umCmk5DZmW3BwkH55EjZZzZaqTXS8vgmI93iobmd50ZqEaeNCixvKajDY1M9u1XiE7wyiBqs6pzBxNPmoVHNCZUcf2aaYjCSQWX028GW968f43nb0+28vWqSMEobuyi1XUvfI04qporjD9kmwRv2BscgiPUlpLVDIfmzKmHQjvKA4hEcH3wByDvDJ02+RZCV4fB9bx59PN6P//KorxwqI2d8FxcOPAtYiF2HQOiPNgC2+KhnAyLHbaAUTGOC8y72CsLi+swBAgvKcJSiS+RyJtK1CPfoT8A07Byy6dxmk/0sdR8JrIHzPXik+CfrDBbeNTzkIWEw4AyA9jQAIu5KKl1FPIhbRkqRhulJ1lFU+PmmRATYpypYaQUZJYG78xuQXD65oh5G+zCNq6fdaDEbVLYGFn6nREOyWiGFSddfBOgKwesDiv/JlOi0lvQ/F3Fa9xjaPeNM80A632cAbtOUzm7CeO4px1RhBzZiCBquyjcl2ZSsUNIxWFDNveyIwJqXsJefV2gW0Cp7OrI+U+bd6zhHy2r7L2E+cYq4utIzLJ3hjBZA0bgsVU2RL5Y9xxeGyqJ9NOOJPkb0rLubPqg5o8TZhT3rEwrgC1QdaUPLPvR2qtmiTB5jFQncTSB/VvRy0gtVjKz2JZFYL7Subr0aI5sYsAjsfwXsGB/bPG7D+95OwU0siST2qq370Uww0DnTjjQ/DceJhvm5fn7cU2p6mwqcDgx7gSagzWKOCMtltgpVIha+BXnDc5GTKIiTXaUTQkRiYepJMVqSP1Gzbh8mtJ5B+1trDvouivPoY8aZl7Cx3SmhLdoUuI8OeT538r4ZFfSrRL+glQ== X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 97565d9a-9a88-4318-5023-08def1386a21 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 08:22:53.5418 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: oOIErjHNRZhDskWiRITt457SEfS5TLQ3yyEmUF5tAL0WVMN5cIOg3APnmB/+WzUnrWyLYb+JlqOQ2avc8w5EO6wBqc0MW3BZZqeW6GoGEZk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB3098 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:22:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242618 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66033 https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66033.patch | 45 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch new file mode 100644 index 0000000000..bb046a6eae --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66033.patch @@ -0,0 +1,45 @@ +From d1b6996c3b31ce6b60d5a820ecc33880e61ef0ae Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Thu, 23 Jul 2026 10:32:04 +0200 +Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in + `ssh2_cipher_crypt()` + +By applying two bounds checks to non-debug builds. + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-c4f7-cvfc-33j7 +Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797 + +Closes #2401 + +CVE: CVE-2026-66033 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6] +Signed-off-by: Jaipaul Cheernam +--- + src/openssl.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/src/openssl.c b/src/openssl.c +index eba05031..28ae1cc0 100644 +--- a/src/openssl.c ++++ b/src/openssl.c +@@ -1042,13 +1042,15 @@ _libssh2_cipher_crypt(_libssh2_cipher_ctx * ctx, + const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0; + /* size of AT, if present */ + const int authenticationtag = IS_LAST(firstlast) ? authlen : 0; +- /* length to encrypt */ +- const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; ++ unsigned int cryptlen; /* length to encrypt */ + + (void)algo; + +- assert(blocksize <= sizeof(buf)); +- assert(cryptlen >= 0); ++ if(blocksize > sizeof(buf) || ++ blocksize < (size_t)(aadlen + authenticationtag)) ++ return 1; ++ ++ cryptlen = (unsigned int)blocksize - aadlen - authenticationtag; + + #if LIBSSH2_AES_GCM + /* First block */ diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 0fe22081be..67dcfb3353 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -16,6 +16,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-1.patch \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ + file://CVE-2026-66033.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Mon Aug 3 08:22:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94280 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2D6BDC5518F for ; Mon, 3 Aug 2026 08:23:08 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.2]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.38774.1785745378456652638 for ; Mon, 03 Aug 2026 01:22:58 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=qtxsevUW; spf=pass (domain: est.tech, ip: 52.101.66.2, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sCGcPa8+oVmQvSPWQ2uooVmjIVtXczYVzNhvFHrtyDotk9eWpGYAKDae0lErUYnklTQHjV7uCidbjGEJ6Xe3RzCIW5BkZ0IVVJkc5nAifJIc4Jk8qx75IEvmM+QreX71XikKkwv8f0zQJZ+WmrHZ0DodTXJUpeOGcWYkSFirXdvkHqCN+Ss/6/ohseglATP51hZSnMaJCdGxdR+3eJfdRinLChEg8NaZKe0P2ev/oAgJAFRCsk2jaLqSwsDDot4hI4EbuqJci3RATljapZcJexkLGP49ZNwOjjjM4Z0Vsphj771bmWM+FEvPQA59TFCkNzwIKjJKC6gB1Q22+KjjRg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=4nHZYW9YJOtNG3ndD48zyP+5oSmFnbNbMjltLlCRaWo=; b=FuFxJyLx4qNfoIgzJQXDZAxzD6al82/DLdRf+MrFzMNQYDspbRTzzllTWVuVBFfHmIk26JNNH51gF8waA6Ypp0Yi9u4oOarXUrDrF3cwDl8T5PzfAxM27aO2cvCUt+pjPXhPzPFqnH0oE5MtT9s2733Sj8kq9xwU0Iop/dqLuHAaq93uq/1XvPizSTrDShN7mMQ7AahlslOqWiDzpVbXwl4fz2W2TpnEND5EYbOYoX6lnoP0L4aCiZNmDBJx3/YtahqI9r0QXQtUjuLi/XKeJobIw6EsKqmxupVpj/2h298AEQoZMiL7AVBleEReK9u8Td5G/wnH/5B4yswwDKl1eQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=4nHZYW9YJOtNG3ndD48zyP+5oSmFnbNbMjltLlCRaWo=; b=qtxsevUWltXXiT+ePHGRdRdTxDhk0ZUG5Unuu6ZBKigs+cHvpzVEMYK0mVFwXhAZDWs3YoTeDihhmPFhDPdZ9oArVNzyW9ek7utajAOVD7N7HdBzopCifTtes0uH2XMsM56Qj+reJIvqlnKxNuR5/cRwZr0Yv1u8Hiz0NfpX4bTlMqtdhO9EVu60fJWECswAkNUAYNzcINdr7YvQAc9HPIg8SMMWd9QG0BuI2iHpf+0LiXagkWF5n36NCKIJEd62ahWyyBbq5olHWAI09+SwE/ZSK9yGBBJpcXXMTFu5XtbQNeGgNt3aj/TwC4xalg8ONGtPSuwxGbc8ZP8Z/cxaEg== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV1P189MB3098.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:25f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 08:22:55 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 08:22:55 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [PATCH 2/3] libssh2: fix CVE-2026-66034 Date: Mon, 3 Aug 2026 10:22:41 +0200 Message-ID: <20260803082242.44009-3-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260803082242.44009-1-jaipaul.cheernam@est.tech> References: <20260803082242.44009-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DB8P191CA0024.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:130::34) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV1P189MB3098:EE_ X-MS-Office365-Filtering-Correlation-Id: 6c293fab-8306-4300-df7e-08def1386b59 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|10067099003|56012099006|11063799006|12006099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: KkeRHIcXou6J35gzWL6qpziSoCzu2U4hTFw/kM4MXc0eeFwjygTY4zW6LvdHx8Oy1/KF38osK5CGtM9fIfZIgKIkNryOd3tUvHkETT2Rv40m6KmAbCUOC1EW9Fd4pwcyTd6nYjyc348VPpPG9vbabCAjLxquxhoBHGpKFha4vHgy+WM+mWFdVLHOsstgxj3VHrDAUUjzXb67BB+kXw1sTzC/QJUzdySx4yl7zXVkxjKfuWQv1G2h28au8/SbEXojxkejnXYV6CIRo1rVQ16LzDn+tdyH77nxj94EKhfGXL9fBunqjrjmUIOLIi+uMAI+QpMBrv2uQkHi0LxYxVwg917/ar48L8d0V+OaK1i+6vrJJwUo5oH/XG9Q7CsKXMkcyK8dWitw7MeXoyNv6mBiKiBAdwIjcpoSBbwhV4F3ih/hfT2QyVZMP9FSSzsowPDUnTZRDqCbL/R+2YzkVx9Ak251DG0rGd1mia6URvVY++mc+dMbGXyQulHNzpntebLro8YqgSM4ZNa4iO0paW8pvY6pARCS6anZC/x4KXlDiNvpvflKEetYeuAUqUwjidzkK1CpvTkgsqYEQ2bxRUsH/+rBTbpYgvNc2RXKToVzBv0B3ajmf1iM3uswLpsB6QoVMTiFWmkXKBVv2UIDFQwWhsqXzrbfKsLRLjenw11vWDA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(10067099003)(56012099006)(11063799006)(12006099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: hByS8hvyvAr7VS89my6UNFaaD9fFItvkJPX9ItGLW8nB0NGAQN5BR9yNIDylsuMTM8BGG07EIVXJ2+dBviuRTxGZM5V8kTNWJlUZlQAK07ggScTMPKJ/xRnYXY3v61eFHWOIuHvnZdMcA4HLoyDNWtmvsBW36mmViuU+3G6Y0UGx/nuhwZ0XDT6rKcMipcHPVH1ZAB5+gjFm/iE9ysx/Lq7keI72i9rNGIuKUBlSEVbIAHEXUUzDZrziBkWIcCowEGJ6q6zyWqNQexXOz2nW9kdR6aXdt8JkFfgp1U2vYI9t5JYM1D8XfnVPzY6/2ZWmyLjr+2hjk6XsiPDBisGSSXebjFJ8o4aRRYGfuBbosvWXWXJc4MOrSfk4gNJL6oxgQ+2d2N9p3T2WWrj6qAFnXwjr375zvjmYFl8cjsJiPbreuaxQ4tczPSRCdqccNv/5TNUdNrncT+7AAXYLm1yuQ0/zWi2O5v2BvHfBmkDGbEFrBvGOLyBLdOsKF2Nz169B03klfrr7igo68e9xuZMW0rTga0PQidN3P1Q9jso62ib6CKhPa2GJgcoCDqtnMp+jvjEwrk8W7aEf+Fs+biVDOaG/bqe7/aO7DSgoJsLGmKMArmOT1hn3XK0C6R2DefouYjSgEoCbw2jeqy4/kFCGnt55DFsumnjWgQvLLrRZI0ysAYAGQGsmUY1YWuBF6yh8oBVm1jqw1NnPhIi6GOqnyMHavFD3xkF9AyJ0BtmkLEqQ02cdrdsWINUgB1f7Y539Fk4Q0DeZ7Qj3hD12lNbLPif6K04B5d5tO78RW5v4uIG1R16CxOd0WzX/bBERmKa4CQ9IMhBFN3WWN/DVaxH6lc3gSi3SRK69KHPRGpuApAhVvgp0I45ddX7f+R+ZPlrP4uSSUw1SgxwmTcSFoZdhxeXzhsNJvYawdHKI9aLntAYE9SYHB6vAWoeNHzCz/I2CCgiTj9+fxm/t2gWNTxVt8AtN5JVcAtfwFRF8ELacgShwYzXzoax8HgwSQ64yBpDmKbwrBbRu8TsmKrSLzATR+bsFJZ27FlvvXLOMLCNY7EFFKfNXTBdCv4y4NPknabVcWQqxAjnH3ZALWxQifczc6T0nDnOu6ThUAQRYPa8fhfqaowSZ8uNNcWGEq8XGmE2aWclAGIelKsFenNrVJ2xO0tcPybUf/84FHit82ZNF40llBM9j+HRrtYFpmurwvp5lpboXe18RVf/AiqoLFgyFUE8r7DOv7SndqSFxsemTx99OKwumK5grptiaL8ZXE1Uif3JYSqetFoTQWdhxAoQ/jBAFaXwcN2ZTPsQwl6VL39gmaMBEZ25O3CfFts0ZPR2U3t8RbApyyfWgg+pmJVtgAgVim97yInfuPPflEXPJuZAtkEkvKdS2iwWsERru8ZACN4uvRrahc1sdb9D2Hh+hQc4LIvdvZ2dD2HcWqxVs/EQHtzL0eiUjAejM8VV3UDpaf4BGcSob6N4wX1delMxCyL6raWu52ht719Fj7NA4uIAcQTZ63AmqVI9b9IpQlZ/wcEBfQ5QCOe3O97CxPzr/PDi4pLmqisx/W9TQNsF2AZHG8H+mSAGZwI+iLeGZSh3pD2mvnX0zEBByNADBbBl5b/a8DoqXGK3W+B+ZIDo5ECS1mS8cuEd84UsWmdsfTFgAhN8jeTiTbynuOG6Ui0w36iH3nPqxWvx1wHosTALsQ01enaZFqgSqmF9VP5Pq/ADo5Uj3P5VaB0pjzcuLHUwS5J+l9VgfPvbO2ce4qpdxzd0= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: 6c293fab-8306-4300-df7e-08def1386b59 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 08:22:55.6434 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 4zoPWt9gIH/mdxrVMD5gMaz+HIm76PkMVWLx4OpIpEOMYUYVPG2JraW/sqplLyvqfYXq+46wByB+5kfAUrEtX5mwVWuaI4Of6Z716726/e0= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB3098 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:23:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242619 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66034 https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66034.patch | 40 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch new file mode 100644 index 0000000000..906356baf2 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66034.patch @@ -0,0 +1,40 @@ +From 16720054e0b3f02e36f31dd04add534d73d4a18d Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Sat, 4 Jul 2026 11:19:49 +0200 +Subject: [PATCH] publickey: fix potential OOB read in + `libssh2_publickey_list_fetch()` + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-w6g9-cpfp-22gc + +Closes #2202 + +Backport adaptations: +- The upstream fix uses ssh2_err() which is not available in libssh2 + 1.11.1. Replace with the equivalent _libssh2_error() call. + +CVE: CVE-2026-66034 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99804cd898d9] +Signed-off-by: Jaipaul Cheernam +--- + src/publickey.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/publickey.c b/src/publickey.c +index 9c9fa618..f3776d2d 100644 +--- a/src/publickey.c ++++ b/src/publickey.c +@@ -988,6 +988,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys, + } + + if(comment_len) { ++ if(pkey->listFetch_s + comment_len > ++ pkey->listFetch_data + pkey->listFetch_data_len) { ++ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL, ++ "ListFetch data too short"); ++ goto err_exit; ++ } ++ + list[keys].num_attrs = 1; + list[keys].attrs = + LIBSSH2_ALLOC(session, diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 67dcfb3353..9db1685e39 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-2.patch \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66033.patch \ + file://CVE-2026-66034.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7" From patchwork Mon Aug 3 08:22:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jaipaul Cheernam X-Patchwork-Id: 94281 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BFEAC55184 for ; Mon, 3 Aug 2026 08:23:08 +0000 (UTC) Received: from DUZPR83CU001.outbound.protection.outlook.com (DUZPR83CU001.outbound.protection.outlook.com [52.101.66.55]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.38775.1785745381841804865 for ; Mon, 03 Aug 2026 01:23:02 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@est.tech header.s=selector1 header.b=lVYK+yDz; spf=pass (domain: est.tech, ip: 52.101.66.55, mailfrom: jaipaul.cheernam@est.tech) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=o6oNHOdlxNT9eDaPhTEi+icKBOm4VXsqUj4w8Mi0GovNQQCwzo4hZ02jQUFuzBse+SHd+WQaJj6tj5uLKkvs+ZNWlwE8pXk184DDE3XEArjUjwK+IHaLO/WwQ7Ox5S6/Im6siLX9ZnkJZ9+HFK6GPONpEbvpjcmPFdBitv9bPs89EfcRxHmSqqRaanhKy73vvtmF/RAX5v3/AiXDbLWG2soCxF5Wm965CxezirVCvxL5iM3PDHpVUoeQ2FP98qpkZizy6XCR4PN7+vrofpT8yCeMh5IkBVcutaUxEMbASsTGnE+hIRJ8DI4/mKFYlaaLWDZQHWDN3tWkQ+f1OW1qGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=vYTMUBitL9RHLKuKL8Gns5id5jUAAI3Fs7OCvlFLzSE=; b=TBgs2gdBvLV78OWVyOdosc6pbx0veL0VhTJbT03TN8b7417Jg9RuGvhEEeK4BjNkgGPKhjKLl3IVfLJUbGwV/ZAB4C6zOt/txIFviufK6+Q/GscScq2vRxghGn8fpDa9j1QX6xZSpNdmFu3ryfHtE8uWVgl6QwGGsU8ABvaSAkGoFAHWEg/JdtGxQdaTwCgabcj5LJ+jvao9qiB2NQ9I547Vkf1QdkBHCgmLGWRoLw1BXKHNcHYJ9KQczdyO+Fh2LDzOFN8uWoHLBXwaKr88navMdEdy3/a0t7ZnvS3z8dsBFWWTHCw0qMs0chPSdLoGnMxSF0/1naGxWZvKfVH/NQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=est.tech; dmarc=pass action=none header.from=est.tech; dkim=pass header.d=est.tech; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=est.tech; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vYTMUBitL9RHLKuKL8Gns5id5jUAAI3Fs7OCvlFLzSE=; b=lVYK+yDziWkl7LhDXXAS5QVKuDdic9DqAzyUsnEK3GW2GNCmpiDadEC8bpikWwqkhCiqU6XMB8h1+/ET+nkkWZqbt8D6A8LKu5xp5FQaPlT1A/ndLOm7uJ8wUenKqB37GJTIr6YjuGUxVL0unJOGlgn3QyrTGI+RqOlHuLrByEI4UAj4fGLMnrdsJOkGcQEgDQCgijtmMS1/P+gPxH4vovLqIDUXRoR109XQ5uJTGj38fPWX+/0O/oucoGKkFGrZKPq2q2rMYVQ/UpgJAkw+YOuAFNrqjqJdylkI7OpvSMpuuFOYTUhueD9eH8Y+9OnsJ3fGWGhitfR1St0hwZSHxw== Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=est.tech; Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) by GV1P189MB3098.EURP189.PROD.OUTLOOK.COM (2603:10a6:150:25f::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.292.13; Mon, 3 Aug 2026 08:22:59 +0000 Received: from DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85]) by DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM ([fe80::7ab2:c6af:6760:5c85%7]) with mapi id 15.21.0292.012; Mon, 3 Aug 2026 08:22:59 +0000 From: Jaipaul Cheernam To: openembedded-core@lists.openembedded.org CC: Jaipaul Cheernam Subject: [PATCH 3/3] libssh2: fix CVE-2026-66035 Date: Mon, 3 Aug 2026 10:22:42 +0200 Message-ID: <20260803082242.44009-4-jaipaul.cheernam@est.tech> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260803082242.44009-1-jaipaul.cheernam@est.tech> References: <20260803082242.44009-1-jaipaul.cheernam@est.tech> X-ClientProxiedBy: DUZPR01CA0333.eurprd01.prod.exchangelabs.com (2603:10a6:10:4b8::27) To DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM (2603:10a6:18:3::ad4) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU7PPF66507B2D7:EE_|GV1P189MB3098:EE_ X-MS-Office365-Filtering-Correlation-Id: f4752757-38ea-42b1-29a6-08def1386d66 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|13003099007|10067099003|56012099006|11063799006|12006099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: jnn4QsDjJ1HjxV6wa3XPjszPtV3eTRKLje66QSj2pnImR+wwJTz6DIm8c7leUqRH9JJ1aDNGtdeccFeyrvFbTzQTweiojZdanqievFfuzhZeK8XN5t2cKeuODHSjr3YeLw8DnSDKThlkGFY08DCqz0K6Af/0yklpjXHeCXAmMcPwJKeU7ka0v/h7mdqEqy4VfoZRuW/oFX2dKwd23zaylvwrJ5w7nvpCZogE+oMImwa1fY99ROhyUCTR91AWSZLIePyOJ0HMHnTHp/5VFjV0ChEIf5JE1j8wRBc4o4do8YYVLp/qgEWIjrv/v2IuAHSBcjn/+Y3oOHDKj/zejnI/+G6IDRbdml0/HK97qEe9bFWxjMROHJmH20E+fQ1j4Cg1l+vX21qyp3LR89/ugRWDWq6sW9ckRa0OZCQpuHobBcCJSFFfkI3Xp+ifgPgN0EsR0pnSoOA9IRpgn4/Na7OeNUD4+tpAEkYttDQH6p70x3V9JVPZqwpwBKWyn4S3TYHgDRSNbKW4CfKC08A5PJJezGOuCDl5iwQNMG90PyRlVS/kklOEJ5Z6ebtHJPHBW7KEMOsbhoiDMRZ4sO0xcnS7eZy1hf5tP+iMO/TtLHYMbHXMhSJEhTjGbCElRINkU+nOsiq1//EIVjYMGLgsGnrri9N0cVSixd0cpN4NF2Q/nJc= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(13003099007)(10067099003)(56012099006)(11063799006)(12006099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: Qevu4RH9GYBJ/oGBAT15Kf6rYGvVv07MWEds5cyyMVQbhumwQtqKEJfJkZ6NtGq7ieAZKCGgcH0AzQ876cL5D2fmJUAIvTzUL8CmfsSNAS5+bE0J0ZkB0B+zzIfyM5DQnbN7+cE2tGDY+0iIKYBdNCLVLS+zftHqiCKyodkZ47yqE2eC/NJUuIzQeVJUfsnZ4BZytMHQI9vlfECEeo5QcI9EobuVSTWFmwG8q02YuGb4RJMFISyjU9LtalSSk/Ap3pwfswIo/8uILvHOuRB/oBtPVDlA4hwe8XHEux71L9yKGetwuAsBpyLkCcQW5cKk5cuxYGOtLQOAbWR41fbZl9DVmV/bsMqzHUb02d7bhxomY2igbivRPurYTYWXEEB9YDw2s7n1jMB+cvVTp2Z/06EMXPeeK6JRT0TVmfP/715f+Y0MTrvSrogq7KP3SzALktLn+wALkH9UBvU05xk+XIM/+Jv9NlmF5rbO03q7+YfipBLbCkQ2m6xZqL7Nr5xzmEC/usFRfAnuRLx5UcUuJoVm8oJT9ZZGoDVk+ApZ9ZaKIC4ls71p8ACZbJ/t0C23Q+l+rVNtFcEGla4SIBQ3aCERZENYC+vdXP4RTAXiRabkd6QN0hMqCdP4oIftkM/itINByE+rzRRG1zDcWrIV65SxLQ0skTXtIWtuTNCITCnnnZ1QhxR/fqffaigPt1nvEhvE+rK4S4fzNyEjZ2WaFu3+zTLxRAwir44Fq+Abq5OHw8bYZMg4+tMXEqc8L0tnN6AlRyvDS7kv7QiGZPPq5H/zrN4IgCew80mVyigk0LFZq6WPQW0xrpIO8qcfiKjNHX3OebR9zyrPb4dsmSl08VLoz8cjK3xcAr0sbGQCuA3XZO+8l23QHJZk2cFXAr/JchnCfjb/oDi+uX6ecjm3YThRngaRBECCarq05SQ8C2z3y2UdwE90DWA191JwUOwCl7GNItvNltKvjwY7Zl5sEii6EEA/XcqxNmSJ0klzn1TgESOULOhnxUhN5vwdSPBfcP761/Ip82ar6qGMiFXUosHtU1KvPAJXX4LRxouMx16Husnt/Z0Qi35mGKYct6IIgxdBXHmePrFFuVz5M+tQmZgcJzS2HsEulDC/IX98dMzoavUFKcjFhkl8BNsYeqwiXr6zLBJDx4/iN4qamwpLxADAf+IeDXPmfG7u84aqKfs54ariXUvbqRZgLBRqcuNi5a6h5zuGstJFS+DsGlQDY9NHvXGGUk6zM2sL2yeqP6gLjgghk88txj8BdDp6D3dh5hghe29GtMsyHEq4z6psS0u2rIHtpQJHAqabk3uBVjUYZQL6/lnRToZTfUb6WlfSRcBF2HS5kttPuIvoQdJ90I8qsKAuxU875kQjJeE4aOzZTvt+11GRdH3dMeRi4NtZIs4m2XK4Bm2PdmJ4LHn+/ztsdJA5QHf2BLs61GmLE9UZEXYTvWz4OLxJdr5d2gcPSpHP/hs5UFrwLNr6UNMk5sDdiPUnWlCWi4MxXLyt/Y86rk9lSza0h5aobww/eq6cOnd5ys0aQ2Givk4S9c49SwEhLR4Zx/V7FuF0T71meAVM8XVnV2XsfCZj4PIoGRd+zuQokMtct/iVTYhQdB/AwoY/4Nbid62onY/EXKte1ua9fMbZv2QhAlj9K96pAl94YV4K3EIFbGzVkQJqNU9prSFHfpClPhOuHyVDJpYb44GfvgxbefOYELz8O9yFE+mY7vup+TU/e7GpUA7uiptp3sAG5wb/JLM6ss3bgTGKQ78= X-OriginatorOrg: est.tech X-MS-Exchange-CrossTenant-Network-Message-Id: f4752757-38ea-42b1-29a6-08def1386d66 X-MS-Exchange-CrossTenant-AuthSource: DU7PPF66507B2D7.EURP189.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Aug 2026 08:22:59.0742 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: d2585e63-66b9-44b6-a76e-4f4b217d97fd X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6h08T07hsfu/YFYgnxly/zW/U3M88TZ4rC7QeHJrVt+a1qFdzuZVxXpN6UyWGKKIV562/9UpaVWFXAHT0MXBV2V4losZWF/s9wfqHmRFGo8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV1P189MB3098 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 03 Aug 2026 08:23:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/242620 Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-66035 https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 libssh2 ptest results (qemux86-64): before: PASSED: 1 FAILED: 0 SKIPPED: 0 after: PASSED: 1 FAILED: 0 SKIPPED: 0 Signed-off-by: Jaipaul Cheernam --- .../libssh2/libssh2/CVE-2026-66035.patch | 56 +++++++++++++++++++ .../recipes-support/libssh2/libssh2_1.11.1.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch new file mode 100644 index 0000000000..7c15f92fb6 --- /dev/null +++ b/meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch @@ -0,0 +1,56 @@ +From 6671019836476649792eea12868a370133be1abe Mon Sep 17 00:00:00 2001 +From: Viktor Szakats +Date: Fri, 3 Jul 2026 18:22:55 +0200 +Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt + +Reported-by: Vladimir Eli Tokarev +Fixes GHSA-6c79-444r-wx26 + +Closes #2198 + +Backport adaptations: +- The upstream fix uses SSH2_SAFEFREE() to safely release allocated + memory and reset the pointer. Since SSH2_SAFEFREE() is not available + in libssh2 1.11.1, replace its usage with the equivalent NULL check, + LIBSSH2_FREE(), and pointer reset sequence. +- The upstream fix renames decrypt() to transport_decrypt(). Since this + rename is not present in libssh2 1.11.1, retain the original + decrypt() function name. + +CVE: CVE-2026-66035 +Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4] +Signed-off-by: Jaipaul Cheernam +--- + src/transport.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/src/transport.c b/src/transport.c +index d147505b..9f386e75 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -242,6 +242,17 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + unsigned char *decrypt_buffer; + int blocksize = session->remote.crypt->blocksize; + ++ if(p->total_num < mac_len + 4 + (size_t)blocksize) { ++ if(p->payload) { ++ LIBSSH2_FREE(session, p->payload); ++ p->payload = NULL; ++ } ++ return LIBSSH2_ERROR_DECRYPT; ++ } ++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4); ++ ++ first_block[0] = 0; ++ + rc = decrypt(session, p->payload + 4, + first_block, blocksize, FIRST_BLOCK); + if(rc) { +@@ -249,7 +260,6 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ ) + } + + /* we need buffer for decrypt */ +- decrypt_size = p->total_num - mac_len - 4; + decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size); + if(!decrypt_buffer) { + return LIBSSH2_ERROR_ALLOC; diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb index 9db1685e39..87352df1ab 100644 --- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb +++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb @@ -18,6 +18,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \ file://CVE-2025-15661-3.patch \ file://CVE-2026-66033.patch \ file://CVE-2026-66034.patch \ + file://CVE-2026-66035.patch \ " SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"