From patchwork Tue Sep 1 08:53:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96946 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id F009FC624D4 for ; Tue, 1 Sep 2026 08:54:26 +0000 (UTC) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3399.1788252849698623592 for ; Tue, 01 Sep 2026 01:54:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=eriD7cJQ; spf=pass (domain: cisco.com, ip: 173.37.142.91, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4545; q=dns/txt; s=iport01; t=1788252849; x=1789462449; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=KTVBUOA1fGEYZD3D6S1xT3jXOIsACxhHqmFoB3gno4M=; b=eriD7cJQDTdvJwEQQ3UwSvlIroJNGrPGfgeq1vZVIpf3EUMdkrcNjzl6 lPBtamGFqZJRgkmk40y1gIP0S/5SlTPbg6t462I6wbHiaj58ivm3y7x9h YdlZDhz5qK7DDRtFvs7PTkYjGUw61T6t7bgidE5vW8GkrEsQTEDbLNj9b reDUt8kOAGn+pm8B1qdWPgWSfC30xRJhXgRhB5xBBqxcBPEYC/OGue0KD Hz18PRV6ymDaidoGchgXXXQiZE97/05rm97i8729nj1+M3Zl9dIxIcCAG hmJafMW1gfvb3PJvltUaCG5Y97KEgvzBABiQ9YfqKRVai9p0ygW9z9H12 A==; X-CSE-ConnectionGUID: /QCksJx/S3G5JflD+CY5CQ== X-CSE-MsgGUID: 0lWk54IqQjOmNrEgoMvCng== X-IPAS-Result: A0BLAgCMkZZq/4sQJK1aglmCV3RfQkkDhFSRcwOeG4F+DwEBAQ9EDQQBAYUFAo13AiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDIwQLARgBLRAJEwMBAgMCJgICKyMIEAmDAgGCdAIBEQagY5sjen8zgQGDKAE/AkNQ2zABCxQBBYEFLoU/gx8BhQJdGAGEfCcbG4FygRWDaYEFgVwEGIUhgmoEgiJ6EoFaiSiIYUiBAhwDWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XNVgbBgWBHYEog0QjGTZ6gQlegSspYAESF4EJgggCgleCAwIBSUMOB0dTCSoCCQsYDUgRLDcVGQQ9AW4Hjl8fglJkFxMBKxQDCXFYKxgFCQM4pS2hDwoog3aMIpU6GjOqbAuYfY4KlgBQhGmBaDyBWXAVgyIJShkPjjiIfscmJDUCCQMvAQEHAgcBAQsBAwuBaJF+AQE IronPort-Data: A9a23:0LJZqq954qkE1SkFt9P5DrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3x 2ZLD2jUOPzeNmqgL9ojPd7i9B9V757VnN9nTQU6/3pEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsYzpNs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2lxBKYb4cRnRloV2 qE6JjQhLTuy2smPlefTpulE3qzPLeHiOIcZ/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFHL2MxKk2bMnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+Oi3bYWJJIHaGq25mG7Ao l3FojjYGygYE9m50xeK9VeyrenAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJZF+k8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:seZs5K8C2SgiNsrnbCFuk+AGI+orL9Y04lQ7vn2ZhyY7TiX+rb HJoB17726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykCsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfiLqWzLzM2f6bQ0/ Gnl7F6mwY= X-Talos-CUID: 9a23:hx2semvmVlzabEJlhS8RwXnh6ItiS1be11XAZHTjJjtLRrm5CnShpYhdxp8= X-Talos-MUID: 9a23:60fHeA9kt0q0Hr807OtBwvSQf59s3KfzVGEUqJchvu+eGCN3Him2ijviFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,255,1779148800"; d="scan'208";a="825746587" Received: from alln-l-core-02.cisco.com ([173.36.16.139]) by alln-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 01 Sep 2026 08:54:08 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-02.cisco.com (Postfix) with ESMTPS id 919701800020D; Tue, 1 Sep 2026 08:54:08 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 2EA04CE1C04; Tue, 1 Sep 2026 01:54:08 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][Patch v2 1/5] libssh: Fix CVE-2026-59843 Date: Tue, 1 Sep 2026 01:53:53 -0700 Message-Id: <20260901085357.1254306-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260901085357.1254306-1-hthakar@cisco.com> References: <20260901085357.1254306-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 08:54:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129621 From: Hetvi Thakar The stable-0.11 commit shown in [1] is the upstream fix selected for this backport. The upstream advisory [2] documents CVE-2026-59843 and identifies libssh 0.11.5 as the fixed release for the 0.11 series. [1] https://git.libssh.org/projects/libssh.git/commit/?id=687ef1c44b646b9db0b1c6e8f987edb7c9e4d919 [2] https://www.libssh.org/security/advisories/CVE-2026-59843.txt Signed-off-by: Hetvi Thakar --- .../libssh/libssh/CVE-2026-59843.patch | 84 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 1 + 2 files changed, 85 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch new file mode 100644 index 000000000..03d3ce6ea --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59843.patch @@ -0,0 +1,84 @@ +From d965eb941a9a83a0643570a93d8997b91e248fc1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Fri, 6 Mar 2026 13:58:30 +0100 +Subject: [PATCH] CVE-2026-59843 channels: Fail when receiving max packet size + 0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Do this both for SSH2_MSG_CHANNEL_OPEN and for +SSH2_MSG_CHANNEL_OPEN_CONFIRMATION. Using the +max packet size 0 would lead to an infinite loop +in channel_write_common. + +Originally reported by Rinku Das on on 23th February. +Independently reported by Yi Lin on 26th February and +Haruto Kimura on 22nd March. + +We do not consider this as a security issue as connecting +to untrusted servers on the internet brings much worse +security consequences than hanging your clinet. + +Signed-off-by: Pavol Žáčik +Reviewed-by: Jakub Jelen + +CVE: CVE-2026-59843 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=687ef1c44b646b9db0b1c6e8f987edb7c9e4d919] + +(cherry picked from commit 44b186fa17aff497dae420c59c003222e438103c) +(cherry picked from commit 687ef1c44b646b9db0b1c6e8f987edb7c9e4d919) +Signed-off-by: Hetvi Thakar +--- + src/channels.c | 7 +++++++ + src/messages.c | 19 +++++++++++++++---- + 2 files changed, 22 insertions(+), 4 deletions(-) + +diff --git a/src/channels.c b/src/channels.c +index 8290dbd1..3afdcf11 100644 +--- a/src/channels.c ++++ b/src/channels.c +@@ -192,6 +192,13 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){ + if (rc != SSH_OK) + goto error; + ++ if (channel->remote_maxpacket == 0) { ++ SSH_LOG(SSH_LOG_RARE, ++ "Invalid maximum packet size 0 in " ++ "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION"); ++ goto error; ++ } ++ + SSH_LOG(SSH_LOG_PROTOCOL, + "Received a CHANNEL_OPEN_CONFIRMATION for channel %d:%d", + channel->local_channel, +diff --git a/src/messages.c b/src/messages.c +index 6dadabf0..e79ecec2 100644 +--- a/src/messages.c ++++ b/src/messages.c +@@ -1160,10 +1160,21 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open){ + SSH_LOG(SSH_LOG_PACKET, + "Clients wants to open a %s channel", type_c); + +- ssh_buffer_unpack(packet,"ddd", +- &msg->channel_request_open.sender, +- &msg->channel_request_open.window, +- &msg->channel_request_open.packet_size); ++ rc = ssh_buffer_unpack(packet, ++ "ddd", ++ &msg->channel_request_open.sender, ++ &msg->channel_request_open.window, ++ &msg->channel_request_open.packet_size); ++ if (rc != SSH_OK){ ++ goto error; ++ } ++ ++ if (msg->channel_request_open.packet_size == 0) { ++ ssh_set_error(session, ++ SSH_FATAL, ++ "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN"); ++ goto error; ++ } + + if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED){ + ssh_set_error(session,SSH_FATAL, "Invalid state when receiving channel open request (must be authenticated)"); diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 1e1b5fb0a..10d063f6d 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -32,6 +32,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-0968-2.patch \ file://CVE-2026-0967.patch \ file://CVE-2026-0965.patch \ + file://CVE-2026-59843.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6" From patchwork Tue Sep 1 08:53:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96948 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19E0AC624D3 for ; Tue, 1 Sep 2026 08:54:27 +0000 (UTC) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3400.1788252856959043929 for ; Tue, 01 Sep 2026 01:54:17 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=C2emn+LS; spf=pass (domain: cisco.com, ip: 173.37.142.94, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3432; q=dns/txt; s=iport01; t=1788252856; x=1789462456; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8vYVSt2dSZ6xouMGoBpjAojSor/2RsoDxS8xDXfcMoY=; b=C2emn+LS/L4lQ5qcFHHxOzktxgLRCwIYMk3uqXMsTGVA+nqk8OVnc3wI Mhn0LrLMaJhd8Ta7jwWDthQvEJyAL30osqXMCozrI40+RQOZfG+bDiqjv 7WN7vWOGqXPCO9akc0B1MCOvQsTzfwj2oPYJOVLki5HjN5jADTVVo7bfm GjRI9zcszXfGytg0QKLG2Xw2FSAZeFzymG+R0e/9FMQbNRAtKIOM1djw6 K1fFfF5X/CNnrjwijkbkdmzovgf7tpp2O96grsRjBAReGt8lij2nUpENo vluIC+3JYmjQvlmrLybY46kIBNeiGvg3XFwmsMKBRjUTJZCczn1/8hFXb w==; X-CSE-ConnectionGUID: qFxXRSjeS0WERrgt/pAyQQ== X-CSE-MsgGUID: 9hUjM5yVTEyuHvM0vsw25Q== X-IPAS-Result: A0BLAgBIkpZq/4wQJK1aHgEBCxIMggULgld0X0JJA4RUkXMDnhuBfg8BAQEPRA0EAQGFBQKNdwImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAyMECwEYAS0QCRMDAQIDAiYCAisjCBAJgwIBgnQCAREGoEubI3p/M4EBgygBPwJDUNswAQsUAQWBBS6FP4MfAYUCXRgBhHwnGxuBcoEVg2mBBYFcBBiFIYJqBIIiehKBWpIJSIECHANZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPhc1WBsGBYEdgSiDRCMZNnqBCV6BKylgARIXgQmCCAKCV4IDAgFJQw4HR1MJKgIJCxgNSBEsNxUZBD0BbgeOXx+CSwdYDBcTAStGgU4YBQkDpWWhDwoog3aMIpU6GjOqbAuYfY4KllCEaYFoPIFZcBWDIglKGQ+OOIh+xyYkNQIJAy8BAQcCBwEBCwEDC4FokX4BAQ IronPort-Data: A9a23:ZRsXhqzlW8XRM2G7NgR6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUHz msZCm7UOP+OYzH2L4p+PY+2/UsFusfUyYcxHldrrVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCea/VH1buSJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 46aT/H3Ygf/hWYlajtMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFgYLb0iweR6Ojlx2 MYCJyxKdjmSvtvjldpXSsE07igiBMDvOIVavjRryivUSK59B5vCWK7No9Rf2V/chOgXQq2YP JRfMGQpNUiYC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZgOKxYYWJJ4TTLSlTtheYm 2DjonXHPjwLKfyB7GKb6W3229aayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc9NUF+t/7ESGzbDZpl7CQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:NpIpbaiQgW2Ms7PYsO87YtpSKnBQXgQji2hC6mlwRA09TyVXra +TdZMgpHnJYVcqKRYdcL+7WZVoLUmwyXcx2/hyAV7AZniDhILXFuFfBOLZqlWKcREWtNQtsJ uIGJIRNDSfNzRHZO/BkXCF+q4bsbq62ZHto/vCxHFwSgwvQaRh4wBlTju/KCRNNXF77V5TLu vn2iKBzADQAkgqUg== X-Talos-CUID: 9a23:bWgJkmtGITwhf/TsRQSIS/7f6Is8XG3t9kzSLnTgNktTUrKJDke56Zpdxp8= X-Talos-MUID: 9a23:K2lcegglnWGClE9iCIpW9cMpZcdV4YHzGX4xvIQbm9ehbTJrJG3AtWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,255,1779148800"; d="scan'208";a="824974501" Received: from alln-l-core-03.cisco.com ([173.36.16.140]) by alln-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 01 Sep 2026 08:54:16 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-03.cisco.com (Postfix) with ESMTPS id E0326180001F5; Tue, 1 Sep 2026 08:54:15 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 7D651CE1C04; Tue, 1 Sep 2026 01:54:15 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][Patch v2 2/5] libssh: Fix CVE-2026-59844 Date: Tue, 1 Sep 2026 01:53:54 -0700 Message-Id: <20260901085357.1254306-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260901085357.1254306-1-hthakar@cisco.com> References: <20260901085357.1254306-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 08:54:27 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129622 From: Hetvi Thakar The stable-0.11 commit shown in [1] is the upstream fix selected for this backport. The upstream advisory [2] documents CVE-2026-59844 and identifies libssh 0.11.5 as the fixed release for the 0.11 series. [1] https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9 [2] https://www.libssh.org/security/advisories/CVE-2026-59844.txt Signed-off-by: Hetvi Thakar --- .../libssh/libssh/CVE-2026-59844.patch | 52 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 1 + 2 files changed, 53 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch new file mode 100644 index 000000000..ac380622d --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59844.patch @@ -0,0 +1,52 @@ +From ef7cd6d4aef6d18ca8bf15cb0398b630284f46f4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Fri, 6 Mar 2026 18:05:29 +0100 +Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len in + SSH_FXP_READ +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The client-provided length is directly used in +a malloc in process_read(), so not restricting it +leads to allocations bounded only by UINT32_MAX. + +The new cap is the same as the one currently used +by OpenSSH. + +Signed-off-by: Pavol Žáčik +Reviewed-by: Jakub Jelen + +CVE: CVE-2026-59844 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=e31f06e5380be4e714d5ad6965981fbf30738da9] + +Backport Changes: +- Replace the upstream goto error path with equivalent direct message cleanup + and return because libssh 0.10.6 does not have the refactored + sftp_make_client_message() error label. + +(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627) +(cherry picked from commit e31f06e5380be4e714d5ad6965981fbf30738da9) +Signed-off-by: Hetvi Thakar +--- + src/sftpserver.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/sftpserver.c b/src/sftpserver.c +index 528ef6f9..77290068 100644 +--- a/src/sftpserver.c ++++ b/src/sftpserver.c +@@ -105,6 +105,13 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) { + sftp_client_message_free(msg); + return NULL; + } ++ if (msg->len > MAX_PACKET_LEN - 1024) { ++ ssh_set_error(sftp->session, SSH_FATAL, ++ "Too large SSH_FXP_READ length: %" PRIu32, ++ msg->len); ++ sftp_client_message_free(msg); ++ return NULL; ++ } + break; + case SSH_FXP_WRITE: + rc = ssh_buffer_unpack(payload, diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 10d063f6d..5c40b80b4 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -33,6 +33,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-0967.patch \ file://CVE-2026-0965.patch \ file://CVE-2026-59843.patch \ + file://CVE-2026-59844.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6" From patchwork Tue Sep 1 08:53:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96945 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94E97C61DD6 for ; Tue, 1 Sep 2026 08:54:26 +0000 (UTC) Received: from alln-iport-8.cisco.com (alln-iport-8.cisco.com [173.37.142.95]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3309.1788252860626039236 for ; Tue, 01 Sep 2026 01:54:20 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=eVdrIaih; spf=pass (domain: cisco.com, ip: 173.37.142.95, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5055; q=dns/txt; s=iport01; t=1788252860; x=1789462460; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=fg+WyYGiUpsDVOkRePQVcsL2NKfldO5kn8iYHtHWkJc=; b=eVdrIaihetjEpbuYKmyAw2Wdif0WziloGyFoHaJAiqo5tv8qRZcV1skO mjoCoK1NI7jIKEWzo/Ufu4zKhL3GxLpSTgTPX9OxzDhVQebZJ4XXWJKkZ 2DyNEPSEbcJHS+5huVQ3vslMVvkd362AeExZH76wiZfsp1dL+LtvNBlPm P3pDGAQdRyJeERXTB+RnKzuPJ29kYxfgWVYL0pdxazjpKE/EIG5BGpCJC lhO1kTh1+aANwNsuw0P+JqUpbffSOmirOFnWm6ZE5nbhMDd1gbMogaLIX Es/bREu4dtGQmi1qkBg55gwfSCJbQcqNGZU5Y6PGGnnXXdZwtUlJQcmVj w==; X-CSE-ConnectionGUID: jyGzd99YSneU+mK89l1K0A== X-CSE-MsgGUID: veD0MIxjTVy8/2mXqwY89g== X-IPAS-Result: A0BMAgBIkpZq/5UQJK1aglmCV3RfQkkDhFSRcwOeG4F+DwEBAQ9EDQQBAYUFAo13AiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDIwQLARgBHg8QCRMDAQIDAiYCAisjCBAJgwIBgnQCAREGoEubI3p/M4EBgygBPwJDUNswAQsUAQWBBS6FP4MfAYUCXRgBhHwnGxuBcoEVg2mBBYFcBBiFIYJqBIIiehKBWh5wkHtIgQIcA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+FzVYGwYFgR2BKINEIxk2eoEJXoErKWABEheBCYIIAoJXggMCAUlDDgdHUwkqAgkLGA1IESw3FRkEPQFuB45fH4IyGQcBPFEBExgXgX0YDgMLAaVZn1GBPgoog3aMIpU6GjOqbAuYfY4KlgZKhGmBaDyBWXAVO4JnCUoZD44tCwuDYIUTxyYkNQIJAy8BAQcCBwEBCwEDC4FokAItgU8BAQ IronPort-Data: A9a23:xhIfnqqApUUM3FMy1wxGof2vmMBeBmJOZBIvgKrLsJaIsI4StFCzt garIBmPOPzYNzHyLd53Pti3/EsG6JbVzdRlT1M6+ShkHngRpePIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOCn9j8kif3gqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgLNNwJcaDpOtfrS8Eo35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0uRmLnNCp K0pEzYAU1OGpLLnxOuYEsA506zPLOGzVG8eknhkyTecCbMtRorOBvyQo9RZxzw3wMtJGJ4yZ eJANmEpN0qGOkMJYwtGYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9KobUGpwJzhrCz o7A13r0Lkk/Fcyd9QSUojX2g9/WghKrCY1HQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwAiJzqyR50OSAXIJC2cbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:MwEtS61aNZGZdYuKusxLiQqjBGwkLtp133Aq2lEZdPWaSKOlfq eV7ZImPH7P+VEssR4b+OxoVJPsfZqYz+8W3WBzB8bHYOCZgguVxehZhOOIqQEIWReOk9K1vp 0PT0ERMrHN5HFB/L/HCXGDYrUd6ejC1ry0juHDyHooZwRrZ6Z8qzpdMG+gYzVLrM0sP+tCKH JajfA33AadRQ== X-Talos-CUID: 9a23:5OEwd2m6slnkSDAhZO5XJ7l/a5nXOX/M42Xcch6JMmBkdf6Qag/B/PpHy+M7zg== X-Talos-MUID: 9a23:qcsY+w1oCM3d0kIl7G7MNZEDIjUj/amCUGUsgZc6hdjUcnZ1Cy6CvWTmTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,255,1779148800"; d="scan'208";a="826714842" Received: from alln-l-core-12.cisco.com ([173.36.16.149]) by alln-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 01 Sep 2026 08:54:19 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-12.cisco.com (Postfix) with ESMTPS id 8920F18000164; Tue, 1 Sep 2026 08:54:19 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 27F56CE1C04; Tue, 1 Sep 2026 01:54:19 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][Patch v2 3/5] libssh: Fix CVE-2026-59846 Date: Tue, 1 Sep 2026 01:53:55 -0700 Message-Id: <20260901085357.1254306-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260901085357.1254306-1-hthakar@cisco.com> References: <20260901085357.1254306-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 08:54:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129623 From: Hetvi Thakar libssh 0.10.6 predates the username-validation helper used by the stable-0.11 fix, so the upstream commit in [1] cannot be applied as-is. Adapt the same dangerous-character check directly at the ProxyCommand %r expansion sink and add focused regression coverage. The upstream advisory [2] identifies libssh 0.11.5 and 0.12.1 as the fixed releases. [1] https://gitlab.com/libssh/libssh-mirror/-/commit/56ce3c193eb06af5bf3b07ec0b4c7308b5c72130 [2] https://www.libssh.org/security/advisories/CVE-2026-59846.txt Signed-off-by: Hetvi Thakar --- Changes in v2 - rebase the patch on the current scarthgap branch --- .../libssh/libssh/CVE-2026-59846.patch | 87 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 1 + 2 files changed, 88 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch new file mode 100644 index 000000000..9c626d113 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59846.patch @@ -0,0 +1,87 @@ +From 19fe4c9fc7b3bd3553250bf9ddea03ed1dcf044f Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Thu, 2 Apr 2026 15:39:25 +0200 +Subject: [PATCH] CVE-2026-59846 Block shell metacharacters from usernames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When an attacker could sneak the dollar sign or backslash into the username +expanded for example in proxy command, it can result in printing environment +variables that might contain secrets. + +This is a fixup of CVE-2023-6004 which fixed this for hostnames, but these +two metacharacters were left out from the username filter. + +This keeps the list in one place to simplify maintenance. + +Signed-off-by: Jakub Jelen +Reviewed-by: Pavol Žáčik +(cherry picked from commit 6309df220e3431deb41946f892f4bb5af8b59dba) + +CVE: CVE-2026-59846 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=56ce3c193eb06af5bf3b07ec0b4c7308b5c72130] + +Backport Changes: +- libssh 0.10.6 predates ssh_check_username_syntax() and the centralized + SSH_DANGEROUS_SHELL_CHARS definition, so enforce the same character list + directly at the %r expansion sink in ssh_path_expand_escape(). +- Add focused regression coverage to the existing path-expansion unit test + for dollar-sign, backslash, and command-separator usernames. + +(cherry picked from commit 56ce3c193eb06af5bf3b07ec0b4c7308b5c72130) +Signed-off-by: Hetvi Thakar +--- + src/misc.c | 9 +++++++++ + tests/unittests/torture_misc.c | 18 ++++++++++++++++++ + 2 files changed, 27 insertions(+) + +diff --git a/src/misc.c b/src/misc.c +index e78c92ba..15b427d7 100644 +--- a/src/misc.c ++++ b/src/misc.c +@@ -1262,6 +1262,15 @@ char *ssh_path_expand_escape(ssh_session session, const char *s) + break; + case 'r': + if (session->opts.username) { ++ if (strpbrk(session->opts.username, ++ "'`\";&<>|(){}$\\,") != NULL) { ++ ssh_set_error(session, ++ SSH_FATAL, ++ "Invalid shell metacharacter in username"); ++ free(buf); ++ free(r); ++ return NULL; ++ } + x = strdup(session->opts.username); + } else { + ssh_set_error(session, SSH_FATAL, +diff --git a/tests/unittests/torture_misc.c b/tests/unittests/torture_misc.c +index 82d6cf16..66d392ed 100644 +--- a/tests/unittests/torture_misc.c ++++ b/tests/unittests/torture_misc.c +@@ -194,6 +194,24 @@ static void torture_path_expand_escape(void **state) { + assert_non_null(e); + assert_string_equal(e, "guru/meditation/222/by/root"); + ssh_string_free_char(e); ++ ++ free(session->opts.username); ++ session->opts.username = strdup("root$HOME"); ++ assert_non_null(session->opts.username); ++ e = ssh_path_expand_escape(session, s); ++ assert_null(e); ++ ++ free(session->opts.username); ++ session->opts.username = strdup("root\\user"); ++ assert_non_null(session->opts.username); ++ e = ssh_path_expand_escape(session, s); ++ assert_null(e); ++ ++ free(session->opts.username); ++ session->opts.username = strdup("root;id"); ++ assert_non_null(session->opts.username); ++ e = ssh_path_expand_escape(session, s); ++ assert_null(e); + } + + static void torture_path_expand_known_hosts(void **state) { diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 5c40b80b4..669e229ee 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -34,6 +34,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-0965.patch \ file://CVE-2026-59843.patch \ file://CVE-2026-59844.patch \ + file://CVE-2026-59846.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6" From patchwork Tue Sep 1 08:53:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96949 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BA500C61DD3 for ; Tue, 1 Sep 2026 08:54:26 +0000 (UTC) Received: from alln-iport-7.cisco.com (alln-iport-7.cisco.com [173.37.142.94]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3402.1788252864540083709 for ; Tue, 01 Sep 2026 01:54:24 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=KFqhz3pU; spf=pass (domain: cisco.com, ip: 173.37.142.94, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=22436; q=dns/txt; s=iport01; t=1788252864; x=1789462464; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=RtkBrr4O7c5nm+6O5oq3sNWJPHOq2c94dU/9fcFSaps=; b=KFqhz3pURgelwwJUOD77BFDNiPcsh7gGmPP8/+lkFYdqgSBArp0PjWlg 2lPPMUY1/gOCf+Rz+jQUTXPAI3uPH+f1uD03pv25ODum9PnG70H4X6A9i c0cTtw+gwdOHWOqOgGrRT8jT9d3Q8RLQW82wHJ9DK5CbXjTWXFWi2ErvC 7LinbVjd3hFyM3/F4QSNIKP00TQNM+jnRQQdTuB91gVCi3n0gdhNGPk/E BRmIA7Wwf02osGfIbgAIWk9D/SaSxoWli+IXtC9ID8+0p2p/2c9mqQ7M6 GnAI22jbx5d6AFrFS37X5ETAGcvQ5FlA6YZx0hf1Oh/Nd1eNI/zOTj3dh Q==; X-CSE-ConnectionGUID: dqBPtKWTRvaarts9fGe9Pw== X-CSE-MsgGUID: aqVyIGCXRPmcN796tRzp2Q== X-IPAS-Result: A0BNAgBIkpZq/5UQJK1aHgEBCxIMggULghg/dF9CSQOEVJFzA4ETnQgUgWoPAQEBD0QNBAEBhQUCjXcCJjQJDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2GWgECAQMaCQQLARgBGxIQCRMDAQIDAiYCAisjCBAJgwIBgnQCAREGoEubI3p/M4EBgygBPwJDUNswAQsUAQWBBS6FP4MfAYUCXRgBRIQ4JxsbgXKBFYJzdoEFgVwEGIENHwKDc4JqBIIiehKBWh5wkHtIgQIcA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+FzVYGwYFgR2BKINEIxk2eoEJXoErKWABEheBCYIIAoJXggMCAUlDDgdHUwkqAgkLGA1IESw3FRkEPQFuB45fH4JSATwnFwkKAQcMGIEFE0IKBCwYBQEIAymSewOSPqEPCiiDdowilToaM4QEpmgLmH2CWYsxlgBQhGmBaDyBWXAVO4JnCUoZD4odhBALC4EUAQKHXMcmJDUCCQMvAQEHAgcBAQsBAwuBaJAAAiYHgU8BAQ IronPort-Data: A9a23:yqB3sarY1u3fEBf60CcgWVsH/yFeBmJOZBIvgKrLsJaIsI4StFCzt garIBmAbqvYazanLdxwbYu09EMOv8TTm9QwGlNuqy43Ey9B8uPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOCn9j8kif3gqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgLNNwJcaDpOtfrS8Eo35ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0upuK1lS1 sMkEi4EZwqfnLO477/qcvY506zPLOGzVG8eknhkyTecCbMtRorOBvyQo9RZxzw3wMtJGJ4yZ eJANmEpN0qGOkMJYwtGYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9KobWFJoJwxnBz o7A123gPAA7G/ev8wKA+VTz17HTpzHjArtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwAiJzqyR50OSAXIJC2cbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWra1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:ESpf0aMGNE6XrsBcTh+jsMiBIKoaSvp037Dk7S9MoHtuA6qlfq GV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFeaTN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn9E4sLxKDwNeOGAbqBJb6 ah2g== X-Talos-CUID: 9a23:aiYV4WOzXz2ZWe5DVDBNzFI3JfwfbHTU1mvLckGXBDdRV+jA X-Talos-MUID: 9a23:VaFbJAxCqO15huTJZStyFanjeFyaqK23NlEsvr42gfGBPgovammBtiavGLZyfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,255,1779148800"; d="scan'208";a="824974571" Received: from alln-l-core-12.cisco.com ([173.36.16.149]) by alln-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 01 Sep 2026 08:54:23 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-12.cisco.com (Postfix) with ESMTPS id 4DFC318000164; Tue, 1 Sep 2026 08:54:23 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id DFE9ACE1C04; Tue, 1 Sep 2026 01:54:22 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][Patch v2 4/5] libssh: Fix CVE-2026-59848 Date: Tue, 1 Sep 2026 01:53:56 -0700 Message-Id: <20260901085357.1254306-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260901085357.1254306-1-hthakar@cisco.com> References: <20260901085357.1254306-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 08:54:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129624 From: Hetvi Thakar The stable-0.11 commit shown in [1] is the primary upstream fix selected for this backport. Commit [2] corrects the request-queue pointer state introduced by [1], so it is carried immediately afterward as a regression fix. The upstream advisory [3] documents CVE-2026-59848 and identifies libssh 0.11.5 as the fixed release for the 0.11 series. [1] https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497 [2] https://git.libssh.org/projects/libssh.git/commit/?id=5309aefd99e1775db40bf20869f1fb1cc6c787be [3] https://www.libssh.org/security/advisories/CVE-2026-59848.txt Signed-off-by: Hetvi Thakar --- Changes in v2 - rebase the patch on the current scarthgap branch --- .../libssh/CVE-2026-59848-regression.patch | 45 ++ .../libssh/libssh/CVE-2026-59848.patch | 684 ++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 2 + 3 files changed, 731 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch new file mode 100644 index 000000000..161271264 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848-regression.patch @@ -0,0 +1,45 @@ +From dddd93ac995ac382e4ec9496509f24003bd72c30 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Wed, 3 Jun 2026 12:56:09 +0200 +Subject: [PATCH] CVE-2026-59848 sftp: Initialize sftp_request_queue ptr in + sftp_free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Pavol Žáčik +Reviewed-by: Jakub Jelen + +CVE: CVE-2026-59848 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=5309aefd99e1775db40bf20869f1fb1cc6c787be] + +Backport Changes: +- Adjusted hunk context for the consolidated libssh 0.10.6 SFTP + implementation; the pointer initialization is unchanged from upstream. +- Omitted the upstream tests/client/torture_sftp_request_id.c follow-up hunk + because CVE-2026-59848.patch introduces the backported regression test + directly with sftp_read_and_dispatch(); there is no intermediate + sftp_recv_response_msg() version to update. + +(cherry picked from commit 00876f7658fd265682708572122502188fa22076) +(cherry picked from commit 5309aefd99e1775db40bf20869f1fb1cc6c787be) +Signed-off-by: Hetvi Thakar +--- + src/sftp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sftp.c b/src/sftp.c +index e6755e2b..ff6e5200 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -371,7 +371,7 @@ void sftp_server_free(sftp_session sftp) + + void sftp_free(sftp_session sftp) + { +- sftp_request_queue ptr; ++ sftp_request_queue ptr = NULL; + struct ssh_iterator *id_it = NULL; + + if (sftp == NULL) { +-- +2.35.6 diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch new file mode 100644 index 000000000..2f4efb22f --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59848.patch @@ -0,0 +1,684 @@ +From ef75e652dd2808c27251da4d03feef84d158c1de Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= +Date: Mon, 1 Jun 2026 16:33:03 +0200 +Subject: [PATCH] CVE-2026-59848 sftp: handle responses with unknown request + IDs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This adds a new field to sftp_session_struct, +containing a list of outstanding request IDs. +An ID is added to the list when a request +is constructed and removed when the corresponding +request is received. If a client receives a response +with an unknown request ID, it reports an error. + +Storing responses with unknown request IDs in +the response queue could be abused by a malicious +SFTP server which could deplete client memory +this way. + +Signed-off-by: Pavol Žáčik +Reviewed-by: Jakub Jelen + +CVE: CVE-2026-59848 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=a30a51003205744c10ba4439306f555206ae8497] + +Backport Changes: +- Consolidated the upstream src/sftp_common.c and src/sftp_aio.c changes + into src/sftp.c, where libssh 0.10.6 implements response dispatch, + request-ID allocation, and asynchronous SFTP reads. +- Kept sftp_get_new_id() static instead of exporting it through + sftp_priv.h because all 20 request-producing call sites in 0.10.6 are + in src/sftp.c; newer-only SFTP API call sites are absent. +- Retained the 0.10.6 request construction order and free the existing + request buffer when request-ID tracking fails. +- Adapted the unknown-ID regression test to call + sftp_read_and_dispatch() and verify the response queue remains empty; + 0.10.6 does not provide sftp_recv_response_msg(). + +(cherry picked from commit 26147eb4767937c797f97ff3b1b1663384232417) +(cherry picked from commit a30a51003205744c10ba4439306f555206ae8497) +Signed-off-by: Hetvi Thakar +--- + include/libssh/sftp.h | 1 + + src/sftp.c | 210 ++++++++++++++++++++++--- + tests/client/CMakeLists.txt | 1 + + tests/client/torture_sftp_request_id.c | 183 +++++++++++++++++++++ + 4 files changed, 369 insertions(+), 26 deletions(-) + create mode 100644 tests/client/torture_sftp_request_id.c + +diff --git a/include/libssh/sftp.h b/include/libssh/sftp.h +index c713466e..984c4eb7 100644 +--- a/include/libssh/sftp.h ++++ b/include/libssh/sftp.h +@@ -90,6 +90,7 @@ struct sftp_session_struct { + void **handles; + sftp_ext ext; + sftp_packet read_packet; ++ struct ssh_list *outstanding_ids; + }; + + struct sftp_packet_struct { +diff --git a/src/sftp.c b/src/sftp.c +index 2194a9ef..e6755e2b 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -149,6 +149,12 @@ sftp_session sftp_new(ssh_session session) + goto error; + } + ++ sftp->outstanding_ids = ssh_list_new(); ++ if (sftp->outstanding_ids == NULL) { ++ ssh_set_error_oom(session); ++ goto error; ++ } ++ + if (ssh_channel_open_session(sftp->channel)) { + goto error; + } +@@ -165,6 +171,7 @@ error: + if (sftp->channel != NULL) { + ssh_channel_free(sftp->channel); + } ++ ssh_list_free(sftp->outstanding_ids); + if (sftp->read_packet != NULL) { + if (sftp->read_packet->payload != NULL) { + SSH_BUFFER_FREE(sftp->read_packet->payload); +@@ -196,6 +203,12 @@ sftp_new_channel(ssh_session session, ssh_channel channel) + goto error; + } + ++ sftp->outstanding_ids = ssh_list_new(); ++ if (sftp->outstanding_ids == NULL) { ++ ssh_set_error_oom(session); ++ goto error; ++ } ++ + sftp->read_packet = calloc(1, sizeof(struct sftp_packet_struct)); + if (sftp->read_packet == NULL) { + ssh_set_error_oom(session); +@@ -217,6 +230,7 @@ error: + if (sftp->ext != NULL) { + sftp_ext_free(sftp->ext); + } ++ ssh_list_free(sftp->outstanding_ids); + if (sftp->read_packet != NULL) { + if (sftp->read_packet->payload != NULL) { + SSH_BUFFER_FREE(sftp->read_packet->payload); +@@ -358,6 +372,7 @@ void sftp_server_free(sftp_session sftp) + void sftp_free(sftp_session sftp) + { + sftp_request_queue ptr; ++ struct ssh_iterator *id_it = NULL; + + if (sftp == NULL) { + return; +@@ -384,6 +399,12 @@ void sftp_free(sftp_session sftp) + + sftp_ext_free(sftp->ext); + ++ id_it = ssh_list_get_iterator(sftp->outstanding_ids); ++ for (; id_it != NULL; id_it = id_it->next) { ++ free((uint32_t *)id_it->data); ++ } ++ ssh_list_free(sftp->outstanding_ids); ++ + SAFE_FREE(sftp); + } + +@@ -571,6 +592,8 @@ static sftp_message sftp_get_message(sftp_packet packet) + { + sftp_session sftp = packet->sftp; + sftp_message msg = NULL; ++ struct ssh_iterator *id_it = NULL; ++ bool id_found = false; + int rc; + + switch(packet->type) { +@@ -618,6 +641,28 @@ static sftp_message sftp_get_message(sftp_packet packet) + msg->id, + msg->packet_type); + ++ /* Validate that this ID is in our outstanding requests list */ ++ id_it = ssh_list_get_iterator(sftp->outstanding_ids); ++ for (; id_it != NULL; id_it = id_it->next) { ++ uint32_t *stored_id = (uint32_t *)id_it->data; ++ if (*stored_id == msg->id) { ++ id_found = true; ++ ssh_list_remove(sftp->outstanding_ids, id_it); ++ free(stored_id); ++ break; ++ } ++ } ++ ++ if (!id_found) { ++ ssh_set_error(packet->sftp->session, ++ SSH_FATAL, ++ "Unknown request ID %" PRIu32, ++ msg->id); ++ sftp_message_free(msg); ++ sftp_set_error(packet->sftp, SSH_FX_FAILURE); ++ return NULL; ++ } ++ + return msg; + } + +@@ -902,13 +947,46 @@ static sftp_message sftp_dequeue(sftp_session sftp, uint32_t id){ + return NULL; + } + +-/* +- * Assigns a new SFTP ID for new requests and assures there is no collision +- * between them. +- * Returns a new ID ready to use in a request ++/** ++ * @brief Assigns a new SFTP ID for new requests and assures there is no ++ * collision between them. ++ * ++ * @param sftp The sftp session handle. ++ * @param id_out Pointer to store the new ID. ++ * ++ * @returns SSH_OK on success with the new ID stored in *id ++ * @returns SSH_ERROR on failure with the sftp and ssh errors set + */ +-static inline uint32_t sftp_get_new_id(sftp_session session) { +- return ++session->id_counter; ++static int sftp_get_new_id(sftp_session sftp, uint32_t *id_out) ++{ ++ uint32_t *id = NULL; ++ int rc; ++ ++ if (id_out == NULL) { ++ ssh_set_error_invalid(sftp->session); ++ sftp_set_error(sftp, SSH_FX_FAILURE); ++ return SSH_ERROR; ++ } ++ ++ id = malloc(sizeof(uint32_t)); ++ if (id == NULL) { ++ ssh_set_error_oom(sftp->session); ++ sftp_set_error(sftp, SSH_FX_FAILURE); ++ return SSH_ERROR; ++ } ++ ++ *id = ++sftp->id_counter; ++ rc = ssh_list_append(sftp->outstanding_ids, id); ++ if (rc != SSH_OK) { ++ free(id); ++ ssh_set_error_oom(sftp->session); ++ sftp_set_error(sftp, SSH_FX_FAILURE); ++ return SSH_ERROR; ++ } ++ ++ *id_out = *id; ++ ++ return SSH_OK; + } + + static sftp_status_message parse_status_msg(sftp_message msg){ +@@ -1029,7 +1107,11 @@ sftp_dir sftp_opendir(sftp_session sftp, const char *path) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(payload); ++ return NULL; ++ } + + rc = ssh_buffer_pack(payload, + "ds", +@@ -1571,7 +1653,11 @@ sftp_attributes sftp_readdir(sftp_session sftp, sftp_dir dir) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(payload); ++ return NULL; ++ } + + rc = ssh_buffer_pack(payload, + "dS", +@@ -1704,7 +1790,11 @@ static int sftp_handle_close(sftp_session sftp, ssh_string handle) + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dS", +@@ -1835,7 +1925,11 @@ sftp_file sftp_open(sftp_session sftp, + sftp_flags |= SSH_FXF_APPEND; + } + SSH_LOG(SSH_LOG_PACKET,"Opening file %s with sftp flags %x",file,sftp_flags); +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "dsd", +@@ -1946,7 +2040,11 @@ ssize_t sftp_read(sftp_file handle, void *buf, size_t count) { + return -1; + } + +- id = sftp_get_new_id(handle->sftp); ++ rc = sftp_get_new_id(handle->sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dSqd", +@@ -2047,7 +2145,11 @@ int sftp_async_read_begin(sftp_file file, uint32_t len){ + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dSqd", +@@ -2173,7 +2275,11 @@ ssize_t sftp_write(sftp_file file, const void *buf, size_t count) { + return -1; + } + +- id = sftp_get_new_id(file->sftp); ++ rc = sftp_get_new_id(file->sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dSqdP", +@@ -2291,7 +2397,11 @@ int sftp_unlink(sftp_session sftp, const char *file) { + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -2366,7 +2476,11 @@ int sftp_rmdir(sftp_session sftp, const char *directory) { + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -2443,7 +2557,11 @@ int sftp_mkdir(sftp_session sftp, const char *directory, mode_t mode) + attr.permissions = mode; + attr.flags = SSH_FILEXFER_ATTR_PERMISSIONS; + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -2538,7 +2656,11 @@ int sftp_rename(sftp_session sftp, const char *original, const char *newname) { + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dss", +@@ -2622,7 +2744,11 @@ int sftp_setstat(sftp_session sftp, const char *file, sftp_attributes attr) + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -2752,7 +2878,11 @@ int sftp_symlink(sftp_session sftp, const char *target, const char *dest) { + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + /* TODO check for version number if they ever fix it. */ + if (ssh_get_openssh_version(sftp->session)) { +@@ -2850,7 +2980,11 @@ char *sftp_readlink(sftp_session sftp, const char *path) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -2976,7 +3110,11 @@ sftp_statvfs_t sftp_statvfs(sftp_session sftp, const char *path) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "dss", +@@ -3051,7 +3189,11 @@ int sftp_fsync(sftp_file file) + return -1; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return -1; ++ } + + rc = ssh_buffer_pack(buffer, + "dsS", +@@ -3151,7 +3293,11 @@ sftp_statvfs_t sftp_fstatvfs(sftp_file file) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "dsS", +@@ -3238,7 +3384,11 @@ char *sftp_canonicalize_path(sftp_session sftp, const char *path) + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -3329,7 +3479,11 @@ static sftp_attributes sftp_xstat(sftp_session sftp, + return NULL; + } + +- id = sftp_get_new_id(sftp); ++ rc = sftp_get_new_id(sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "ds", +@@ -3407,7 +3561,11 @@ sftp_attributes sftp_fstat(sftp_file file) + return NULL; + } + +- id = sftp_get_new_id(file->sftp); ++ rc = sftp_get_new_id(file->sftp, &id); ++ if (rc != SSH_OK) { ++ SSH_BUFFER_FREE(buffer); ++ return NULL; ++ } + + rc = ssh_buffer_pack(buffer, + "dS", +diff --git a/tests/client/CMakeLists.txt b/tests/client/CMakeLists.txt +index 71e5182e..864478a7 100644 +--- a/tests/client/CMakeLists.txt ++++ b/tests/client/CMakeLists.txt +@@ -49,6 +49,7 @@ if (WITH_SFTP) + torture_sftp_dir + torture_sftp_read + torture_sftp_fsync ++ torture_sftp_request_id + ${SFTP_BENCHMARK_TESTS}) + endif (WITH_SFTP) + +diff --git a/tests/client/torture_sftp_request_id.c b/tests/client/torture_sftp_request_id.c +new file mode 100644 +index 00000000..fe6d3f91 +--- /dev/null ++++ b/tests/client/torture_sftp_request_id.c +@@ -0,0 +1,183 @@ ++#include "config.h" ++ ++#define LIBSSH_STATIC ++ ++#include "sftp.c" ++#include "torture.h" ++ ++#include ++#include ++ ++static int sshd_setup(void **state) ++{ ++ torture_setup_sshd_server(state, false); ++ ++ return 0; ++} ++ ++static int sshd_teardown(void **state) ++{ ++ torture_teardown_sshd_server(state); ++ ++ return 0; ++} ++ ++static int session_setup(void **state) ++{ ++ struct torture_state *s = *state; ++ struct passwd *pwd = NULL; ++ int rc; ++ ++ pwd = getpwnam("bob"); ++ assert_non_null(pwd); ++ ++ rc = setuid(pwd->pw_uid); ++ assert_return_code(rc, errno); ++ ++ s->ssh.session = torture_ssh_session(s, ++ TORTURE_SSH_SERVER, ++ NULL, ++ TORTURE_SSH_USER_ALICE, ++ NULL); ++ assert_non_null(s->ssh.session); ++ ++ s->ssh.tsftp = torture_sftp_session(s->ssh.session); ++ assert_non_null(s->ssh.tsftp); ++ ++ return 0; ++} ++ ++static int session_teardown(void **state) ++{ ++ struct torture_state *s = *state; ++ ++ torture_rmdirs(s->ssh.tsftp->testdir); ++ torture_sftp_close(s->ssh.tsftp); ++ ssh_disconnect(s->ssh.session); ++ ssh_free(s->ssh.session); ++ ++ return 0; ++} ++ ++static void torture_sftp_request_id_null(void **state) ++{ ++ struct torture_state *s = *state; ++ struct torture_sftp *t = s->ssh.tsftp; ++ sftp_session sftp = t->sftp; ++ int rc; ++ ++ rc = sftp_get_new_id(sftp, NULL); ++ assert_int_equal(rc, SSH_ERROR); ++} ++ ++static void torture_sftp_request_id_add(void **state) ++{ ++ struct torture_state *s = *state; ++ struct torture_sftp *t = s->ssh.tsftp; ++ sftp_session sftp = t->sftp; ++ uint32_t id1, id2; ++ int rc; ++ size_t count; ++ ++ /* The list of IDs should be empty at first */ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 0); ++ ++ /* Request a new ID */ ++ rc = sftp_get_new_id(sftp, &id1); ++ assert_int_equal(rc, SSH_OK); ++ ++ /* Check that the list has one ID now */ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 1); ++ ++ /* Request another ID */ ++ rc = sftp_get_new_id(sftp, &id2); ++ assert_int_equal(rc, SSH_OK); ++ ++ /* Check that the IDs differ */ ++ assert_int_not_equal(id1, id2); ++ ++ /* Check that the list has two IDs now */ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 2); ++} ++ ++static void torture_sftp_request_id_remove(void **state) ++{ ++ struct torture_state *s = *state; ++ struct torture_sftp *t = s->ssh.tsftp; ++ sftp_session sftp = t->sftp; ++ sftp_attributes attr = NULL; ++ size_t count; ++ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 0); ++ ++ /* We send a request and receive a response */ ++ attr = sftp_stat(sftp, SSH_EXECUTABLE); ++ assert_non_null(attr); ++ ++ /* The number of outstanding requests should be back to 0 */ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 0); ++ ++ sftp_attributes_free(attr); ++} ++ ++static void torture_sftp_request_id_unknown(void **state) ++{ ++ struct torture_state *s = *state; ++ struct torture_sftp *t = s->ssh.tsftp; ++ sftp_session sftp = t->sftp; ++ ssh_buffer buffer = NULL; ++ uint32_t id = 0; ++ int rc; ++ size_t count; ++ ++ count = ssh_list_count(sftp->outstanding_ids); ++ assert_int_equal(count, 0); ++ ++ buffer = ssh_buffer_new(); ++ assert_non_null(buffer); ++ ++ rc = ssh_buffer_pack(buffer, "ds", id, "/tmp"); ++ assert_int_equal(rc, SSH_OK); ++ ++ /* Send a request without saving the request ID */ ++ rc = sftp_packet_write(sftp, SSH_FXP_OPENDIR, buffer); ++ assert_int_not_equal(rc, -1); ++ SSH_BUFFER_FREE(buffer); ++ ++ /* An attempt to receive the response should fail without queuing it */ ++ rc = sftp_read_and_dispatch(sftp); ++ assert_int_equal(rc, -1); ++ assert_null(sftp->queue); ++} ++ ++int torture_run_tests(void) ++{ ++ int rc; ++ struct CMUnitTest tests[] = { ++ cmocka_unit_test_setup_teardown(torture_sftp_request_id_null, ++ session_setup, ++ session_teardown), ++ cmocka_unit_test_setup_teardown(torture_sftp_request_id_add, ++ session_setup, ++ session_teardown), ++ cmocka_unit_test_setup_teardown(torture_sftp_request_id_remove, ++ session_setup, ++ session_teardown), ++ cmocka_unit_test_setup_teardown(torture_sftp_request_id_unknown, ++ session_setup, ++ session_teardown), ++ }; ++ ++ ssh_init(); ++ ++ torture_filter_tests(tests); ++ rc = cmocka_run_group_tests(tests, sshd_setup, sshd_teardown); ++ ssh_finalize(); ++ ++ return rc; ++} +-- +2.35.6 diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 669e229ee..960621eac 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -35,6 +35,8 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-59843.patch \ file://CVE-2026-59844.patch \ file://CVE-2026-59846.patch \ + file://CVE-2026-59848.patch \ + file://CVE-2026-59848-regression.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6" From patchwork Tue Sep 1 08:53:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 96947 X-Patchwork-Delegate: anuj.mittal@oss.qualcomm.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E09EFC624D1 for ; Tue, 1 Sep 2026 08:54:26 +0000 (UTC) Received: from alln-iport-3.cisco.com (alln-iport-3.cisco.com [173.37.142.90]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3403.1788252865978600501 for ; Tue, 01 Sep 2026 01:54:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=iofumtu8; spf=pass (domain: cisco.com, ip: 173.37.142.90, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3085; q=dns/txt; s=iport01; t=1788252866; x=1789462466; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=cJsZtq9vPWjPVrwQyFIQ3D0ODUv4JGg3MLylsD2Mg64=; b=iofumtu8tXrViAcOFe28zsc5QdMv/djoFDZW3as649+mj33wc2mtHufy r9iENRgL8oeP5vH2j7yRy4pYKCWyKOcCDYGoDy2hEgt2ABZyd471MwBlC AOqwuXrXkrf3sbdEYOv0j4jfvOQityJFItyIWxkzWyLgnuNXPq9MdjYy8 0nSP5uYbRZGxiIVqucmcIwAPF0M9V9pDHl+9PjgjGcJsSYRt+POw8Llma 4O6DCM9du8rGPpArxT0DYpmK7WYxhIyaTxCP7Ljy8Eedn0qlDa6hprZ7w EmFqNRUnavqRELzfvn8R9wD+gmQpteBB6+H/qKrnK+utcQwojhf/yFztK Q==; X-CSE-ConnectionGUID: rjgNDP8iRL624I+shAfKgw== X-CSE-MsgGUID: v93+M20aQGqRo083DKx8WQ== X-IPAS-Result: A0BMAgBIkpZq/5AQJK1aglmCV3RfQkkDhFSRcwOeG4F+DwEBAQ9EDQQBAYUFAo13AiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAyMECwEYAS0QCRMDAQIDAiYCAisjCBAJgwIBgnQCAREGoEubI3p/M4EBgygBPwJDUNswAQsUAQWBBS6FP4MfAYUCXRgBhHwnGxuBcoEVg2mBBYFcBBiFIYJqBIIiehKBWm6RG0iBAhwDWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XNVgbBgWBHYEog0QjGTZ6gQlegSspYAESF4EJgggCgleCAwIBSUMOB0dTCSoCCQsYDUgRLDcVGQQ9AW4Hjl8fgksHDlYqASuCFBgFCQOTAJJloQ8KKIN2jCKVOhozqmwLmH2OCpZQhGmBaDyBWXAVgyIJShkPjjiIfscmJDUCCQMvAQEHAgcBAQsBAwuBaJF+AQE IronPort-Data: A9a23:ZwSaf6w2azodVBLmAN96t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUEx mFMXDjQP6rYYzPyf94nYN/l9hkC7ZHXmoMxGgs5rVhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 46aT/H3Ygf/hWYlajtMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJFs0Mqs0wrZ2O0UQr 6A5aysNRx6giP3jldpXSsE07igiBMDvOIVavjRryivUSK55B5vCWK7No9Rf2V/chOgXQq2YP JRfMGQpNUicC/FMEg9/5JYWnPuoj3r2aRVTqUmeouw85G27IAlZgOS3boSJKo3RLSlTtljJ/ SHjpTzwOz4DDtvHmWGp0WL8udaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc9NUF+t/7ESGzbDZpl7GQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYS71Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:j0JX6Kn/tPHkKlzHaChNKgU10pDpDfLy3DAbv31ZSRFFG/FwWf rAoB19726TtN9xYgBGpTnuAsi9qB/nmKKdpLNhX4tKPzOW3FdAUrsD0WKK+VSJcEfDH6xmpM JdmsNFZuEYY2IXsS/S2njALz9Z+qjlzImYwcHD0nxqUQZmL4tk7wt/F0KnN3cefng/OXL8f6 DsnPauYFGbCA8qUvg= X-Talos-CUID: 9a23:UDgWvGye/sSkTPerD4fGBgUOGM8DXkWNzU30fRXkKCVySJSbalCPrfY= X-Talos-MUID: 9a23:7tCQUwrd2fJEVr4xWwcezy8zb4RNufynMW8Uq5Je65KoFjwgBA7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,255,1779148800"; d="scan'208";a="842664893" Received: from alln-l-core-07.cisco.com ([173.36.16.144]) by alln-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 01 Sep 2026 08:54:25 +0000 Received: from sjc-ads-4178.cisco.com (sjc-ads-4178.cisco.com [171.70.54.199]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "ciscoit-managed-infra-smtp-auth.cisco.com", Issuer "Internal Private TLS SubCA" (verified OK)) by alln-l-core-07.cisco.com (Postfix) with ESMTPS id E7409180001C3; Tue, 1 Sep 2026 08:54:24 +0000 (GMT) Received: by sjc-ads-4178.cisco.com (Postfix, from userid 1887505) id 84476CE1C04; Tue, 1 Sep 2026 01:54:24 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [OE-core][scarthgap][Patch v2 5/5] libssh: Fix CVE-2026-59850 Date: Tue, 1 Sep 2026 01:53:57 -0700 Message-Id: <20260901085357.1254306-6-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260901085357.1254306-1-hthakar@cisco.com> References: <20260901085357.1254306-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: VERIFIED;sjc-ads-4178.cisco.com [171.70.54.199];TLSv1.3;TLS_AES_256_GCM_SHA384;256;ciscoit-managed-infra-smtp-auth.cisco.com X-Outbound-SMTP-Client: 171.70.54.199, sjc-ads-4178.cisco.com X-Outbound-Node: alln-l-core-07.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 08:54:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129625 From: Hetvi Thakar The stable-0.11 commit shown in [1] is the upstream fix selected for this backport. The upstream advisory [2] documents CVE-2026-59850 and identifies libssh 0.11.5 as the fixed release for the 0.11 series. [1] https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2 [2] https://www.libssh.org/security/advisories/CVE-2026-59850.txt Signed-off-by: Hetvi Thakar --- .../libssh/libssh/CVE-2026-59850.patch | 40 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 1 + 2 files changed, 41 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch new file mode 100644 index 000000000..61e502c79 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-59850.patch @@ -0,0 +1,40 @@ +From a207ee3b4244c0e5da902245f8b81f3617b416f3 Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Wed, 1 Jul 2026 16:43:08 +0200 +Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets on + closed channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Jakub Jelen +Reviewed-by: Pavol Žáčik + +CVE: CVE-2026-59850 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=6edfb52b3b364577d2db0334c0514a977efceed2] + +(cherry picked from commit a8a3fa352bb5213e08a35e4494c6e44360e2e38a) +(cherry picked from commit 6edfb52b3b364577d2db0334c0514a977efceed2) +Signed-off-by: Hetvi Thakar +--- + src/channels.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/src/channels.c b/src/channels.c +index 3afdcf11..1543c792 100644 +--- a/src/channels.c ++++ b/src/channels.c +@@ -575,6 +575,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){ + channel->local_window, + channel->remote_window); + ++ if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) { ++ SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel"); ++ ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel"); ++ SSH_STRING_FREE(str); ++ return SSH_PACKET_USED; ++ } ++ + /* What shall we do in this case? Let's accept it anyway */ + if (len > channel->local_window) { + SSH_LOG(SSH_LOG_RARE, diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 960621eac..ccfa55e0d 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -37,6 +37,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://CVE-2026-59846.patch \ file://CVE-2026-59848.patch \ file://CVE-2026-59848-regression.patch \ + file://CVE-2026-59850.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"