From patchwork Fri Oct 16 03:52:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100948 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7BDDCC6B2D for ; Fri, 16 Oct 2026 03:52:44 +0000 (UTC) Received: from rcdn-iport-9.cisco.com (rcdn-iport-9.cisco.com [173.37.86.80]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14416.1792122758296922573 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=eGYodol8; spf=pass (domain: cisco.com, ip: 173.37.86.80, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2836; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=r5VTbcg2PTJlUoZR4O0wcBqP8CmFkHexHZLBv6H9oUU=; b=eGYodol8bjYX2cfAVjHmyB8BXEPg8hlwdRjiabPkxe49eAb7OrUAzVES jQDec+mFBAg4okdX3Qmnj2E17wkoHDBSo+qLrVTfuBR/ZxAKd4yzR+Et5 hvBpnGmRHSH2MIWHbvRZFjS0Bo1FHmD8dlat+2wJHBD2ZZewwq+y9QZa1 Mvaj2dtORV5n3/9KpwR3wQljKojH1BnGZcBYdD9s0TkmZdn8MgbN96i2t MUhTNSWx5dfIFxs9u5Evok/LeT0GuMvqgVTkzNI48nw9WpQbBWhgJM3p7 ARWFBXog4KyYEmMJiZMXJbV96M1PxEZ/1LDIDz1Cvjbm/hVahZbg0gnFr w==; X-CSE-ConnectionGUID: G5Jucg81RFukpopNTnc20w== X-CSE-MsgGUID: iJzAGrNhQ2+wgtRTKXRNJg== X-IPAS-Result: A0BIAgAbntFq/4r/Ja1aglmCV3VgQ0kDlkqeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBLRAcAwECLysjCBmDAgGCdAMRvG+CLIEBgykBPwJDUNsyAQsUAQWBM4VAiCNdGAGEfCcbG4FyhH6BBYFcAgOCKoV4BIIiehKBWh6VKUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJlexMBK4IspXWhDwoog3aMIpU6GjOqbwuYfY4Klk+EaYFoPIFZcBWDIglKGQ+OOYNrhRPJRycyCwMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:3G1jF6jER0l/tSj4pE8/nQMuX161NhEKZh0ujC45NGQN5FlHY01je htvDTqEOPbbNDbwct9/aN7ipExUucDTyNBkHgA6+yg3RitjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU3p8RqCm4er MY2NTMVaQilu+S9muqkH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGuPB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWYQd/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIYHQFZQNxRjwS mTu/kbrKz4AEtymk3ma/W6Wusz/pwXZV9dHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cF3hKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Nxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:veCj76voIMw+F7F6//v54kQf7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:LgwDuG4vyeyXS2tttdss2xM2B8sqIiTn4mrTO0igL1pvQ+fNVgrF X-Talos-MUID: 9a23:nqgmIA2VlLYFrw8H79XiJd2rhzUj4oa8IW8Xt5U/4YqbOjBKBxStthKVTdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535289036" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-9.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 456DB18000314; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id E33F3CBF201; Thu, 15 Oct 2026 20:52:36 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 01/10] openssh: Fix CVE-2026-106584 Date: Thu, 15 Oct 2026 20:52:27 -0700 Message-Id: <20261016035236.442896-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247912 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/aef20dfe30e68a469911a229b9117e7134766311 [2] https://ubuntu.com/security/CVE-2026-106584 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106584.patch | 39 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch new file mode 100644 index 0000000000..31b35aad9a --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106584.patch @@ -0,0 +1,39 @@ +From aef20dfe30e68a469911a229b9117e7134766311 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Tue, 15 Sep 2026 08:31:46 +0000 +Subject: [PATCH] upstream: Correct handling of DST when converting dates + +Timestamps conversion was ignoring Daylight Savings Time (DST) causing +date conversions to be +/-1 hour under some circumstances. + +bz4004; from Khush Patel, ok deraadt + +OpenBSD-Commit-ID: bd5eb2603c04d4b5072b0e593b137a98ef75b731 + +CVE: CVE-2026-106584 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/aef20dfe30e68a469911a229b9117e7134766311] + +Backport Changes: +- Omitted the upstream misc.c OpenBSD revision-only hunk. OpenSSH 10.3p1 + also lacks earlier error-sentinel handling; that is not part of this + DST fix and is not imported here. + +(cherry picked from commit aef20dfe30e68a469911a229b9117e7134766311) +Signed-off-by: Hetvi Thakar +--- + misc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/misc.c b/misc.c +--- a/misc.c ++++ b/misc.c +@@ -2591,6 +2591,7 @@ parse_absolute_time(const char *s, uint64_t *tp) + if ((tt = timegm(&tm)) < 0) + return SSH_ERR_INVALID_FORMAT; + } else { ++ tm.tm_isdst = -1; /* mktime decides DST */ + if ((tt = mktime(&tm)) < 0) + return SSH_ERR_INVALID_FORMAT; + } +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 0b34e4563c..aceaa6420f 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -34,6 +34,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-73283.patch \ file://CVE-2026-73282.patch \ file://CVE-2026-73281.patch \ + file://CVE-2026-106584.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100956 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5DB9BCCF2C0 for ; Fri, 16 Oct 2026 03:52:45 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14168.1792122761166508507 for ; Thu, 15 Oct 2026 20:52:41 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=FXAjA5mk; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=9801; q=dns/txt; s=iport01; t=1792122761; x=1793332361; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=qTj2lgruXwSDN0TnhERdlula0qs6/B9Q9nwwq4mVXfI=; b=FXAjA5mkdxH1zDNvsYzAReNh8sWOiV8/WdLa/33pzQ9HBv50qd2WDX/n yU8HonlzHs6NJBrBkdFFkGHYp5g3OarsBeZ732Gmq1uPzji0Yq026tWlf h28pS68/zOI31WKjbTfaNCEa1/UIWN9LtILuGC1OmL2XFfpwLILO/P1TE ZJIuVEYSgfsCS+VnU3Emy0MN/nOGcjqTKdnoSiX2BzoM3X4cYM2ytwKvl NPb8YBfhYVlvcglW/aajPUz7vSNlVL2kSaPyvpayAfojUjg8haH3CL/NV rR47FHHuLCQCEGdh+E6JpGpJgp4mGaURuMb05mqCFw/6j8soW21Pqqrzu Q==; X-CSE-ConnectionGUID: EoZiaW5pSrivbh/Urkvlyg== X-CSE-MsgGUID: lmQbKYm/SK26DEKrEMatkg== X-IPAS-Result: A0BJAgAtn9Fq/5T/Ja1aglmCV3VgQ0kDlkcDnhyBfg8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGR6CZAGCdAMRvHKBeTOBAYMpAT8CQ1DbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAgOIIgSCInoSgVoelSlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CXgcBWTQBK0Z/SB+TP5I2oQ8KKIN2jCKVOhozqm8LmH2OCpZPhGmBaDyBWXAVgyIJShkPji4LC4NghRPJRycyCwMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:xBgkg6MEwaSJATvvrR3zlsFynXyQoLVcMsEvi/4bfWQNrUojhjZWm GYYDG3QPPaON2X9eI91YYi38kMHucTUnIVhHnM5pCpnJ55oRWUpJjg4wmPYZX76whjrFRo/h ykmQoCeap1yFjmD9k/F3oHJ9RFUzbuPSqf3FNnKMyVwQR4MYCo6gHqPocZh6mJTqYb/WVzlV e/a+ZWFZgb9gmAsawr41orawP9RlKWq0N8nlgRWicBj5Df2i3QTBZQDEqC9R1OQapVUBOOzW 9HYx7i/+G7Dlz91Yj9yuu+mGqGiaue60Tmm0hK6aYD76vRxjnBaPpIACRYpQRw/ZwNlMDxG4 I4lWZSYEW/FN0BX8QgXe0Ew/ypWZcWq9FJbSJSymZT78qHIT5fj69hpPkA/AtAAwfx2H2tOs sECKy4Jfx/W0opawJrjIgVtrt4oIM+uOMYUvWttiGiAS/0nWpvEBa7N4Le03h9p2ZsIRqmYP ZdEL2MzPHwsYDUXUrsTIJIinO6rj2PXeDxDo1XTrq0yi4TW5FEqjuG8YICIJbRmQ+1Rm3+Sh VPDuF/aWE82Gf+F5B+M7nGj07qncSTTHdh6+KeD3vlyjVuew2YeBBEbWR6wpuO0okq/QM5Eb UsM9ywjqKI/+ECmQp/6RRLQnZKflgQXV9wVF6gx7xuAj/ONpQ2YHWMDCDVGbbTKqfMLeNDj7 XfR9/uBONClmOL9pa61nltMkQ6PBA== IronPort-HdrOrdr: A9a23:pHk8uq2Q2X9cH/x+i1cnYQqjBGokLtp133Aq2lEZdPWaSKOlfq eV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFebvN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn5E4sLxKDwMeOGAbqBJbK ah2g== X-Talos-CUID: 9a23:zJHRImiHber7Tv50keyDMXi/8jJuX3rvzX7vfleDE2d3Qr3SdEWT5qd1nJ87 X-Talos-MUID: 9a23:5jcwEgp3U/wcDSYDlfcezzVnDc1L0qHpM2NXz7krmNOpECVsODjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536198257" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 4A1691800016D; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id E6F37CBF202; Thu, 15 Oct 2026 20:52:36 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 02/10] openssh: Fix CVE-2026-106586 Date: Thu, 15 Oct 2026 20:52:28 -0700 Message-Id: <20261016035236.442896-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247922 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f [2] https://ubuntu.com/security/CVE-2026-106586 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106586_p1.patch | 39 +++++++ .../openssh/openssh/CVE-2026-106586_p2.patch | 101 ++++++++++++++++++ .../openssh/openssh/CVE-2026-106586_p3.patch | 39 +++++++ .../openssh/openssh_10.3p1.bb | 3 + 4 files changed, 182 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch new file mode 100644 index 0000000000..a694424cf4 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p1.patch @@ -0,0 +1,39 @@ +From 991f1f31dde2797416acaf4319dbebe764446c6f Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:33:44 +0000 +Subject: [PATCH] upstream: Propagate authorized_keys "resrict" keyword + +The "restrict" keyword was not pervasively being applied to TunnelForwarding +connections (which are administratively disabled by default). This is a +separate problem to the one fixed in openssh-10.5 + +reported by several people; ok markus, deraadt + +OpenBSD-Commit-ID: 8c36c31dc2bdbc0c432d1056496b2f1ce93198d1 + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/991f1f31dde2797416acaf4319dbebe764446c6f] + +Backport Changes: +- Omitted the upstream OpenBSD revision-only hunk and retained the + Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit 991f1f31dde2797416acaf4319dbebe764446c6f) +Signed-off-by: Hetvi Thakar +--- + auth-options.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/auth-options.c b/auth-options.c +--- a/auth-options.c ++++ b/auth-options.c +@@ -604,6 +604,7 @@ sshauthopt_merge(const struct sshauthopt *primary, + OPTFLAG_AND(no_require_user_presence); + /* Restrictive flags are logical-OR (i.e. must be set in either) */ + OPTFLAG_OR(require_verify); ++ OPTFLAG_OR(restricted); + #undef OPTFLAG_AND + + /* Earliest expiry time should win */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch new file mode 100644 index 0000000000..10a2abe497 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p2.patch @@ -0,0 +1,101 @@ +From ded92bffa2e2f2db9b83245c5061812791bfa47f Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 04:51:28 +0000 +Subject: [PATCH] upstream: correctly check sshauthopt->restricted merging + +OpenBSD-Regress-ID: e81e9267514338d6cf6bd2f83dcb722538af528e + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/ded92bffa2e2f2db9b83245c5061812791bfa47f] + +Backport Changes: +- Omitted the upstream tests.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit ded92bffa2e2f2db9b83245c5061812791bfa47f) +Signed-off-by: Hetvi Thakar +--- + regress/unittests/authopt/tests.c | 41 +++++++++++++++++++++-------------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c +--- a/regress/unittests/authopt/tests.c ++++ b/regress/unittests/authopt/tests.c +@@ -418,13 +418,14 @@ test_merge(void) + } while (0) + + /* Check a single case of merging of flag options */ +-#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, var, val) \ ++#define FLAG_CASE(keybase, label, keyname, keywords, mostly_off, \ ++ rflag, var, val) \ + do { \ + PREPARE(keybase " " label, keyname, keywords); \ +- expected = mostly_off ? \ +- sshauthopt_new() : default_authkey_opts(); \ +- expected->var = val; \ ++ expected = rflag ? default_authkey_restrict_opts() : \ ++ (mostly_off ? sshauthopt_new() : default_authkey_opts()); \ + ASSERT_PTR_NE(expected, NULL); \ ++ expected->var = val; \ + CHECK_SUCCESS_AND_CLEANUP(); \ + TEST_DONE(); \ + } while (0) +@@ -437,40 +438,40 @@ test_merge(void) + #define FLAG_TEST(keybase, keyword, var) \ + do { \ + FLAG_CASE(keybase, "keys:default,yes cert:default,no", \ +- "no_" keybase, keyword, 0, var, 0); \ ++ "no_" keybase, keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase,"keys:-*,yes cert:default,no", \ +- "no_" keybase, "restrict," keyword, 1, var, 0); \ ++ "no_" keybase, "restrict," keyword, 1, 1, var, 0); \ + FLAG_CASE(keybase, "keys:default,no cert:default,no", \ +- "no_" keybase, "no-" keyword, 0, var, 0); \ ++ "no_" keybase, "no-" keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:default,no", \ +- "no_" keybase, "restrict,no-" keyword, 1, var, 0); \ ++ "no_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:-*,yes", \ +- "only_" keybase, keyword, 1, var, 1); \ ++ "only_" keybase, keyword, 1, 0, var, 1); \ + FLAG_CASE(keybase,"keys:-*,yes cert:-*,yes", \ +- "only_" keybase, "restrict," keyword, 1, var, 1); \ ++ "only_" keybase, "restrict," keyword, 1, 1, var, 1); \ + FLAG_CASE(keybase, "keys:default,no cert:-*,yes", \ +- "only_" keybase, "no-" keyword, 1, var, 0); \ ++ "only_" keybase, "no-" keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:-*,yes", \ +- "only_" keybase, "restrict,no-" keyword, 1, var, 0); \ ++ "only_" keybase, "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:-*", \ +- "no_permit", keyword, 1, var, 0); \ ++ "no_permit", keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase,"keys:-*,yes cert:-*", \ +- "no_permit", "restrict," keyword, 1, var, 0); \ ++ "no_permit", "restrict," keyword, 1, 1, var, 0); \ + FLAG_CASE(keybase, "keys:default,no cert:-*", \ +- "no_permit", "no-" keyword, 1, var, 0); \ ++ "no_permit", "no-" keyword, 1, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:-*", \ +- "no_permit", "restrict,no-" keyword, 1, var, 0); \ ++ "no_permit", "restrict,no-" keyword, 1, 1, var, 0); \ + \ + FLAG_CASE(keybase, "keys:default,yes cert:*", \ +- "all_permit", keyword, 0, var, 1); \ ++ "all_permit", keyword, 0, 0, var, 1); \ + FLAG_CASE(keybase,"keys:-*,yes cert:*", \ +- "all_permit", "restrict," keyword, 1, var, 1); \ ++ "all_permit", "restrict," keyword, 1, 1, var, 1); \ + FLAG_CASE(keybase, "keys:default,no cert:*", \ +- "all_permit", "no-" keyword, 0, var, 0); \ ++ "all_permit", "no-" keyword, 0, 0, var, 0); \ + FLAG_CASE(keybase, "keys:-*,no cert:*", \ +- "all_permit", "restrict,no-" keyword, 1, var, 0); \ ++ "all_permit", "restrict,no-" keyword, 1, 1, var, 0); \ + \ + } while (0) + FLAG_TEST("portfwd", "port-forwarding", permit_port_forwarding_flag); +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch new file mode 100644 index 0000000000..6defa83ec6 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106586_p3.patch @@ -0,0 +1,39 @@ +From a30bafcbbd44dc4dc91916240c32ecabff899338 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 04:56:12 +0000 +Subject: [PATCH] upstream: simpler + +OpenBSD-Regress-ID: c7f30b865abd0b3e0e5514f861509c32e352a760 + +CVE: CVE-2026-106586 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/a30bafcbbd44dc4dc91916240c32ecabff899338] + +Backport Changes: +- Omitted the upstream tests.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit a30bafcbbd44dc4dc91916240c32ecabff899338) +Signed-off-by: Hetvi Thakar +--- + regress/unittests/authopt/tests.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/regress/unittests/authopt/tests.c b/regress/unittests/authopt/tests.c +--- a/regress/unittests/authopt/tests.c ++++ b/regress/unittests/authopt/tests.c +@@ -422,10 +422,11 @@ test_merge(void) + rflag, var, val) \ + do { \ + PREPARE(keybase " " label, keyname, keywords); \ +- expected = rflag ? default_authkey_restrict_opts() : \ +- (mostly_off ? sshauthopt_new() : default_authkey_opts()); \ ++ expected = mostly_off ? \ ++ sshauthopt_new() : default_authkey_opts(); \ + ASSERT_PTR_NE(expected, NULL); \ ++ expected->restricted = rflag; \ + expected->var = val; \ + CHECK_SUCCESS_AND_CLEANUP(); \ + TEST_DONE(); \ + } while (0) +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index aceaa6420f..7760dae931 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -35,6 +35,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-73282.patch \ file://CVE-2026-73281.patch \ file://CVE-2026-106584.patch \ + file://CVE-2026-106586_p1.patch \ + file://CVE-2026-106586_p2.patch \ + file://CVE-2026-106586_p3.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100951 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B1A5CCA48F for ; Fri, 16 Oct 2026 03:52:45 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14165.1792122758374104954 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=E3I4zsUN; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3809; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=oiu/W1PqltvOJpUUHkqYuCLyI9cTKWkVX9eKNmiKLeg=; b=E3I4zsUNMs6TB51ka7rsXHCI5n6WGfoC9HiouFmwD/Y1hK26CJ1VnrDV CI6akf7HkisDFjW3lwMVKVQE2S1TnNlH3aSWXYwIX2AwCZdtoZzhozEsM ExEOi56x+JIwdIF9i4Jq7vzRjvbA08iQd2HB1+BgNFg2vzC7mbJzNX05m Ptn5Ya3S9g+EOV4oxZ3icNsXP9XbUnUT6nQ2NgnfERnsP9Awaa1HKkok5 Gb5YUP14RHjGp84MpsN4IIY6EgXXtQJ171QXpr5BCFo7nVBGUwhVx46OO nMgEdELG9ZbsX40FfaQKFu+qpgNTEiWoqJpTguU7HrMiAeykwkAbP40ux w==; X-CSE-ConnectionGUID: vLN0gyqxQTG9YmawNARiIw== X-CSE-MsgGUID: uie0gWa5SJqAeB3bD9xE5Q== X-IPAS-Result: A0BMAgCwntFq/43/Ja1aglmCGD91YENJA4RUkXMDnhyBfg8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDIwQLARgBLRAcAwECAwImAgIrIwgZgwIBgnQDEbxwen8zgQGDKQE/AkNQ2zIBCxQBBYEFLoVAgx8BhQNdGAGEfCcbG4FygRWDaYEFgVwCA4U4gmoEgiJ6EoFaHpUpSIECHANZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPhcvWBsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD0BbgeSFB6CZTEoNQETGIE0eJM1kkChDwoog3aMIpU6GjOqbwuYfY4KlTWBGoRpgWg8gVlwFYMiCUoZD445gR8BAoJJhRPJRycyCwMvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:CeKWgqws5nbTG2f2o456t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUAy TQaDWvVO6rbZTDxe4p1adux8B5SsJDUy4AyS1Zqq1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJF8SG9UX6/9nOF1hp M0dIS8rRyqCpv3jldpXSsE07igiBNPgMIVavjRryivUSK56B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cOnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+OW3YIKPJ43XG625mG6Fp 2+e8FvwXyo4LfWS42GP3iO8q7L2yHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rbyyjVSzc9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7FQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSj1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:FdFRwaz2NqJ3lreW6ZmYKrPw8r1zdoMgy1knxilNoNJuHfBw8P re+sjztCWE7wr5N0tApTntAsS9qDbnhPxICOoqTNOftXfd2FdARbsKheCJ/9SjIVyaygc378 ldmsZFZOEYJGIK9PoSmDPIcOoI8Z2g7L2ig/vYwjNGSAFnbLwl0iJCYzzranGfgGJ9dOAE/F 323Ls9mwad X-Talos-CUID: 9a23:5SKzZmGlmBPs4DGIqmJ50GhMFdE8YkTh4ybhJkanL09TSZyKHAo= X-Talos-MUID: 9a23:nXeqpwp8OjqPTMbuOgQezyxjOZ9n3K3zM2IUuJgs4MOoZDxdZg7I2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528025956" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id 4BE0F18000182; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id EBCEACBF203; Thu, 15 Oct 2026 20:52:36 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 03/10] openssh: Fix CVE-2026-106587 Date: Thu, 15 Oct 2026 20:52:29 -0700 Message-Id: <20261016035236.442896-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247913 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/526fd2771342f36142099bec82c49ce0457c5016 [2] https://ubuntu.com/security/CVE-2026-106587 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106587.patch | 62 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 63 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch new file mode 100644 index 0000000000..203dd8cc05 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106587.patch @@ -0,0 +1,62 @@ +From 526fd2771342f36142099bec82c49ce0457c5016 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:35:09 +0000 +Subject: [PATCH] upstream: Correctly handle some options that accept "none" + +Some options, including AuthorizedPrincipalsFile were documented as accepting +"none" as a way to disable them, however when overriddes by a ssh_config(5) +Match keyword, this argument was being interpreted as a literal file. + +With Chris Rohlf in collaboration with Claude and Anthropic Research + +ok markus, deraadt + +OpenBSD-Commit-ID: 802f3a7695eba20924c05e500b0ecd34ec877756 + +CVE: CVE-2026-106587 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/526fd2771342f36142099bec82c49ce0457c5016] + +Backport Changes: +- Omitted the upstream servconf.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. +- Adapted the fix to OpenSSH 10.3p1's manual Match-option copy routine; + the upstream commit uses generated option-copy helpers. Left the + older version's existing post-authentication cleanup in place, so + the CLEAR_ON_NONE macro is undefined immediately after the three + pre-authentication options rather than reused below. + +(cherry picked from commit 526fd2771342f36142099bec82c49ce0457c5016) +Signed-off-by: Hetvi Thakar +--- + servconf.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/servconf.c b/servconf.c +--- a/servconf.c ++++ b/servconf.c +@@ -2884,6 +2884,23 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) + + /* Arguments that accept '+...' need to be expanded */ + assemble_algorithms(dst); ++ ++ /* ++ * These options may be "none" to clear a global setting.  They are ++ * consulted before authentication, so they must be cleared here ++ * rather than in the post-auth section below. ++ */ ++#define CLEAR_ON_NONE(v) \ ++ do { \ ++ if (option_clear_or_none(v)) { \ ++ free(v); \ ++ v = NULL; \ ++ } \ ++ } while(0) ++ CLEAR_ON_NONE(dst->authorized_principals_file); ++ CLEAR_ON_NONE(dst->trusted_user_ca_keys); ++ CLEAR_ON_NONE(dst->banner); ++#undef CLEAR_ON_NONE + + /* + * The only things that should be below this point are string options +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 7760dae931..a70ca30b15 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -38,6 +38,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106586_p1.patch \ file://CVE-2026-106586_p2.patch \ file://CVE-2026-106586_p3.patch \ + file://CVE-2026-106587.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100954 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50C25CCA490 for ; Fri, 16 Oct 2026 03:52:45 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14166.1792122758379997954 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=VJMolb29; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=5218; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=b0p18UgTa0VmWlsrkv43zM7vDFCI4ZcVkuSeYgFF36I=; b=VJMolb29/Hlq91wioGdLvrd7f0uYOIkbHFZ8IWPrHPV0aWGpWdVekemL t08zQFVwHorTX2udOhNIyMWAokvnGIQ9xuybfY8dZqUK7DwUeDXwhMVO7 aYoAWehHSWOlSORG0e2HHwlQNLKCk0kHwNE2P7zdoa8P5e2WjdeTM2n3E /rUXkTJxzsuSsP24GqcfXuHYHoCozZElapRhc/L231WCgzZOHjAdLF5AT zno+4F7c+fGzHTwVMURG5axfxnua5inVnsDcVb9wvAT1z2r5GYMqCRryh LyTk4evaKuCVygpXsVZvL6pLN+WlhtnUASUKYXz3teWk4+MbRd4PHPDWH Q==; X-CSE-ConnectionGUID: +hga9ZPNQE275TwIpXvGoQ== X-CSE-MsgGUID: nytoUcE8QOimTVhNAV98dA== X-IPAS-Result: A0DQAgCwntFq/5X/Ja1aglmCV3VgQ0kDhFSRcwOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNQgOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMjBAsBGAEtEBwDAQIDAiYCAisjCBAJgwIBgnQDEbxwen8zgQGDKQE/AkNQ2zIBCxQBBYEFLoVAgx8BhQNdGAGCSYIzJxsbgXKBFYNpgQWBXAIDhTiCagSCDRV6EoFaHoRwkDlIgQIcA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+Fy9YGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPQFuB5IUHoJeBwZTNQErgWtBDgGTAiYBkj2hDwoog3aMIpU6GjOqbwuYfY4KlgVKhGmBagI4gVlwFYMiCUoZD445g2uFE8lHJzILAy8BAQcCBwEMAQMLgWiRfgEB IronPort-Data: A9a23:6EgWual1SG3UhQBMiqMxdh3o5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJJUDvUa6qNY2X2Kth3OYm//EpUsZ6GzdFhSAQ/pH1kFltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4Errav6+/SEUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZK31GONgWYubDtMsvzb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05Fc4Y9e8mM1loz NFCd20xcTGbt/yZx4vuH4GAhux7RCXqFJkUtnclyXTSCuwrBMmZBa7L/tRfmjw3g6iiH96HO JFfMmUpNkmdJUQTaz/7C7pm9AusrnnjczRboUi9rqss6G+Vxwt0uFToGIeOJIXXHZkMwS50o ErA7nj+Pxo3ZOW4yD+5zHKKr9GezS/SDdd6+LqQs6QCbEeo7msLBRsbUFG2rfW0hgu1XMhSA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO/cx5AfIzu/f5ByUQzFeCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u78Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:EDXs8qP+/8pvscBcTh+jsMiBIKoaSvp037Dk7S9MoHtuA6qlfq GV7ZMmPHDP6Qr5NEtMpTnEAtjjfZq+z+8Q3WBuB9eftWDd0QPCRr2Kr7GSpgEIcBeRygcy78 tdmoFFeaTN5CBB/KXHyTj9Nco8y9+a963tr+Lfw3BxCTxOUchbnn9E4sLxKDwNeOGAbqBJb6 ah2g== X-Talos-CUID: 9a23:FKl7RGNfxze3fu5DGylo/R8mIuYcXyeCkUvPAleIF0lucejA X-Talos-MUID: 9a23:bjNasQ1GYI0Ypfy9ISSoxV1RHTUj5bWyD30GvMU/nMiBCRJwHR6j3WS7a9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536150417" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 51D6618000335; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id F05C3CBF204; Thu, 15 Oct 2026 20:52:36 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 04/10] openssh: Fix CVE-2026-106582 Date: Thu, 15 Oct 2026 20:52:30 -0700 Message-Id: <20261016035236.442896-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247914 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace [2] https://ubuntu.com/security/CVE-2026-106582 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106582.patch | 97 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 98 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch new file mode 100644 index 0000000000..53c5cb6f47 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106582.patch @@ -0,0 +1,97 @@ +From 1d5340fce24526719e32aebc4c721fc228182ace Mon Sep 17 00:00:00 2001 +From: "job@openbsd.org" +Date: Tue, 22 Sep 2026 04:38:09 +0000 +Subject: [PATCH] upstream: Disable LZ77 dictionary coder to avoid a potential + +side-channel leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +A chosen-plaintext attack method exists which makes use of +dictionary-based compression to recover secrets from one channel by +interacting with the SSH session's shared compression dictionary through +another channel. + +Attacker-controlled input can recognizably reflect into the total length +of transmitted ciphertexts by virtue of LZ77 replacing repeated strings +with back-references into the SSH session's encoder search buffer, +which is shared across all channels. For this reason, the documentation +already recommended against enabling compression for connections that +share trusted and untrusted traffic. + +As an extra precaution, use only Huffman coding when compressing +plaintexts, as this algorithm does not use a dictionary. But, this +results in a reduction of compression effectiveness. + +Inspired by "Crossing the Streams: SSH Plaintext Recovery via a Common +Compression Context in Multiplexed Channels." by Fabian Bäumer and +Marcus Brinkmann, preprint https://arxiv.org/abs/2609.07709 (2026) + +OK djm@ dtucker@ + +OpenBSD-Commit-ID: 839e5e53ad76786d0e90bed530304e4e13acbba0 + +CVE: CVE-2026-106582 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1d5340fce24526719e32aebc4c721fc228182ace] + +Backport Changes: +- Omitted the upstream packet.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit 1d5340fce24526719e32aebc4c721fc228182ace) +Signed-off-by: Hetvi Thakar +--- + packet.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +diff --git a/packet.c b/packet.c +--- a/packet.c ++++ b/packet.c +@@ -802,13 +802,12 @@ ssh_packet_init_compression(struct ssh *ssh) + #ifdef WITH_ZLIB + static int +-start_compression_out(struct ssh *ssh, int level) ++start_compression_out(struct ssh *ssh) + { +- if (level < 1 || level > 9) +- return SSH_ERR_INVALID_ARGUMENT; +- debug("Enabling compression at level %d.", level); ++ debug("Enabling compression."); + if (ssh->state->compression_out_started == 1) + deflateEnd(&ssh->state->compression_out_stream); +- switch (deflateInit(&ssh->state->compression_out_stream, level)) { ++ switch (deflateInit2(&ssh->state->compression_out_stream, ++ Z_BEST_SPEED, Z_DEFLATED, 15, 8, Z_HUFFMAN_ONLY)) { + case Z_OK: + ssh->state->compression_out_started = 1; + break; +@@ -934,7 +933,7 @@ uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out) + #else /* WITH_ZLIB */ + + static int +-start_compression_out(struct ssh *ssh, int level) ++start_compression_out(struct ssh *ssh) + { + return SSH_ERR_INTERNAL_ERROR; + } +@@ -1040,7 +1039,7 @@ ssh_set_newkeys(struct ssh *ssh, int mode) + if ((r = ssh_packet_init_compression(ssh)) < 0) + return r; + if (mode == MODE_OUT) { +- if ((r = start_compression_out(ssh, 6)) != 0) ++ if ((r = start_compression_out(ssh)) != 0) + return r; + } else { + if ((r = start_compression_in(ssh)) != 0) +@@ -1185,7 +1184,7 @@ ssh_packet_enable_delayed_compress(struct ssh *ssh) + if ((r = ssh_packet_init_compression(ssh)) != 0) + return r; + if (mode == MODE_OUT) { +- if ((r = start_compression_out(ssh, 6)) != 0) ++ if ((r = start_compression_out(ssh)) != 0) + return r; + } else { + if ((r = start_compression_in(ssh)) != 0) +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index a70ca30b15..129c62090f 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -39,6 +39,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106586_p2.patch \ file://CVE-2026-106586_p3.patch \ file://CVE-2026-106587.patch \ + file://CVE-2026-106582.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100952 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E97ECCA48B for ; Fri, 16 Oct 2026 03:52:45 +0000 (UTC) Received: from rcdn-iport-1.cisco.com (rcdn-iport-1.cisco.com [173.37.86.72]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14167.1792122758432712248 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=DogiDpb1; spf=pass (domain: cisco.com, ip: 173.37.86.72, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2904; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=gHC2yEz6QTknnqM21C7tC5AjbPcgOkxzyMcLLOtsPZI=; b=DogiDpb1Iv7wGBLjmCygY/QgeVAbf0oqxDRTi+CForoKCwmXK/HGkme7 TAUZ5d6NBoKNRShqVjqN6cXBN7Yqm1GxQfOm962NipgoxT0AFxuaND9AR i2q5uZnB2STc/Fs97MaW9taWqrew05W+PhBfJhLTxDcRZ93NCSwQudBt8 zolAFDmCwSuBeALpT1uVv4ycb2erDMBopUmeCZ+6sE4BgQMaZ69P7NcAP /ini/tx6kD7q+fOjkG2NrFKIrjok1Uh9aATnu9wBpW9ilK1K6prXp0Mx8 jrho3YigpUEvWvvBk2baW61tDyoPG/8E7sBPa8xWSmuhqWa6UnNjB2Y4Z w==; X-CSE-ConnectionGUID: ILzDJJRvQBehHy82nZ7b2Q== X-CSE-MsgGUID: h3dTcBzSSIWAQq+RRaa90A== X-IPAS-Result: A0BJAgCwntFq/43/Ja1aglmCV3VgQ0kDlkcDnhyBfg8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAEtEBwDAQIvKyMIGYMCAYJ0AxG8cIF5M4EBgykBPwJDUNsyAQsUAQWBM4VAiCNdGAGEfCcbG4FyhH6BBYFcAgOCKoV4BIIiehKBWh6VKUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJeBwF6EwErgiyTOJI9oQ8KKIN2jCKVOhozqm8LmH2OCpVnaIRpgWg8gVlwFYMiCUoZD445g2uFE8lHJzILAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:9A72cKjg4kjC0eM7KFDEL+HCX161NhEKZh0ujC45NGQN5FlHY01je htvDWmHaP6PYGT0Ld92OY2woEkBsMfVytAwQAc+/iE2QytjpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqU53vRbI0N06 8UyJTAtf0DZgdDpyuiCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbH+PB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWZg5/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIYHbFJ4MxxbwS mTu/z/1PhowJuek6AWsy2vvvNXGlHKjcddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cEnhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Oxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:cXtYjKOECSMheMBcThmjsMiBIKoaSvp037Dk7S9MoHtuA6ulfq +V/cjzuSWYtN9VYgBDpTniAtjlfZqjz/5ICOAqVN/INjUO+lHYSb2KhrGN/9SPIUHDH8dmpM FdmtBFeb7NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPHhXg2UK1XYDNu5deXcGPDV7OQ== X-Talos-CUID: 9a23:d+SsKWGcCrTD6VV0qmJG0Fw4OOIfbET3wXfwMh/iD1Q2QuesHAo= X-Talos-MUID: 9a23:d2463Q35rCwuzFGvZwdZlHHXkjUj4/+iNEsng649mvatDDUzAQ2UhWXva9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535993118" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id A476D18000182; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 0151BCBF21E; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 05/10] openssh: Fix CVE-2026-106585 Date: Thu, 15 Oct 2026 20:52:31 -0700 Message-Id: <20261016035236.442896-6-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247919 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/e0f85d83ccc15b1b218fa8a000fc29a2e3d2defd [2] https://ubuntu.com/security/CVE-2026-106585 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106585.patch | 44 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106585.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106585.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106585.patch new file mode 100644 index 0000000000..08f992f54c --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106585.patch @@ -0,0 +1,44 @@ +From e0f85d83ccc15b1b218fa8a000fc29a2e3d2defd Mon Sep 17 00:00:00 2001 +From: "job@openbsd.org" +Date: Tue, 22 Sep 2026 22:51:43 +0000 +Subject: [PATCH] upstream: Check that compressed payloads don't inflate beyond the + +maximum payload length + +From a report by Oleh Konko (1seal) + +OK djm@ + +OpenBSD-Commit-ID: a0d3e7aa432777c28bfe23e5447ac117d6c151d9 + +CVE: CVE-2026-106585 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e0f85d83ccc15b1b218fa8a000fc29a2e3d2defd] + +Backport Changes: +- Omitted the upstream packet.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit e0f85d83ccc15b1b218fa8a000fc29a2e3d2defd) +Signed-off-by: Hetvi Thakar +--- + packet.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/packet.c b/packet.c +--- a/packet.c ++++ b/packet.c +@@ -907,10 +907,12 @@ uncompress_buffer(struct ssh *ssh, struct sshbuf *in, struct sshbuf *out) + switch (status) { + case Z_OK: + if ((r = sshbuf_put(out, buf, sizeof(buf) - + ssh->state->compression_in_stream.avail_out)) != 0) + return r; ++ if (sshbuf_len(out) >= PACKET_MAX_SIZE) ++ return SSH_ERR_INVALID_FORMAT; + break; + case Z_BUF_ERROR: + /* + * Comments in zlib.h say that we should keep calling + * inflate() until we get an error. This appears to +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 129c62090f..3e927154f5 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -40,6 +40,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106586_p3.patch \ file://CVE-2026-106587.patch \ file://CVE-2026-106582.patch \ + file://CVE-2026-106585.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100955 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 352AECCA491 for ; Fri, 16 Oct 2026 03:52:45 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14417.1792122758616888354 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fENrgNUD; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1426; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=F2JbVUUHePYlDJXhLWo5EtdLpsIPVFP3plezZcFBQro=; b=fENrgNUDufpdthgecALc/pXk3jR4Ey0Mzc7f/mtHQSFcx8oAMkPyojbb Vda8MqpIRImipXdu/SgE9iWIb4ja+vC0s4dEnafwjFZVVMb4EZYJH2GAh 9KENkM7obCjXE+H0AL8F0dMRzQG2pVLOrvG8pC2y9smuTYhffsMTUnr5m t4fjwJD0QF8XkDTgeOaE/cn0z9VurU89erHSFUVKm4J2LjCk1436ptswx TpSXCgX99LJ9wuhAtYPHI342teXYbd1KFCQdMyFi4ADHDqxoukW4yCTSn lb7/74ztVsrfKVMgKuA8byjiYH46do2CXV0M2DtJwF2i7esd+42+11nr4 A==; X-CSE-ConnectionGUID: VZfxaXeKRICyqkqGkQuh1A== X-CSE-MsgGUID: d0GLoXXqQCG6bE5LwWinyQ== X-IPAS-Result: A0D8AgCwntFq/47/Ja1aglmCV3VgQ0kDlkcDnhyBfg8BAQEPPRQEAQGFBQKOFQImNgcOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEwIBAzIBGAEtECAxKysZgwIBgnQDEbxwgiyBAYMpAT8CQ1DbMgELFAEFgTOFQIgjdQGEfCcbG4FyhH6BBYQLhXgEgiJ6EoF4lSlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYAEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZVo0LAQcgWUnEaVkoQ8KKIN2jCKVOhozqm8LmH2OCpZPhGmBbwUwgVlwFYMiCUoZD445g2vOWicyDi8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:wK9b/aKg6PgCKRdXFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENS0WADz zcYXG+EOfeMajehfI8jbYji9kMF65OEn4NrSVEd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1QPk8mNL0V2dxWKnBX9 uU3KwkQbkmq0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBULAtQIvIROPB4towMDUY358VW62BI ZBENHw2ME6ojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+azb4qLIIfiqcN9kh63g mX2z33AKT5EPvHC7SW683S9v7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MvkCSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:a8j5QKNmQG+1HsBcThmjsMiBIKoaSvp037Dk7S9MoHtuA6ulfq +V/cjzuSWYtN9VYgBDpTniAtjlfZqjz/5ICOAqVN/INjUO+lHYSb2KhrGN/9SPIUHDH8dmpM FdmtBFeb7NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPHhXg2UK1XYDNu5deXcGPDV7OQ== X-Talos-CUID: 9a23:9pmuMmrQmHkpMUJKh0YUs8jmUf4XfG3U/HrzGW6TGH9qUZKWcEKQoYoxxg== X-Talos-MUID: 9a23:NvP19Qg+A17pLKXzZTcqOcMpOJ9Hx6OeOFk0urpYseTZETNPOjGMtWHi X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536678623" Received: from rcdn-l-core-05.cisco.com ([173.37.255.142]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-05.cisco.com (Postfix) with ESMTPS id A957F18000346; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 04EF7CBEF8A; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 06/10] openssh: Ignore CVE-2026-106588 Date: Thu, 15 Oct 2026 20:52:32 -0700 Message-Id: <20261016035236.442896-7-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-05.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:45 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247916 From: Hetvi Thakar Analysis: - This issue requires OpenSSH built with the macOS 27 or later SDK. - Wrynose targets Linux and cannot select the Darwin sandbox. Reference: https://ubuntu.com/security/CVE-2026-106588 Signed-off-by: Hetvi Thakar --- meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 3e927154f5..6799e10b99 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -56,6 +56,7 @@ CVE_STATUS[CVE-2023-51767] = "upstream-wontfix: It was demonstrated on modified CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh." CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" +CVE_STATUS[CVE-2026-106588] = "not-applicable-platform: Requires the macOS 27 or later SDK and Darwin sandbox; Wrynose builds OpenSSH for Linux." PAM_SRC_URI = "file://sshd" From patchwork Fri Oct 16 03:52:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100947 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C0B64CC6B38 for ; Fri, 16 Oct 2026 03:52:44 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.14168.1792122761166508507 for ; Thu, 15 Oct 2026 20:52:41 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=W6nmGNvR; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1568; q=dns/txt; s=iport01; t=1792122761; x=1793332361; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=s/n7MbEMvx15yfnL2ms416WNVbeFO/gnm3FE7MQ2LRE=; b=W6nmGNvRJjgAyKGKe75hxQHyxQjC6mCuWhi2nmIvzu8nvBjx7H+ggIGQ gowDFisOzXzJHBunFwT20jijY6UUZpd0vxwXaCkzmbnpj3zuzAo/2bUzx EWfVCFSz/oPQpK497ud/+t9GMAiHBKlVmFoZPhW+69zyobFBkfoUVx/Bh t4oCn5XTgv1gtIqTmNFRd25R1x83oDagfmRzvCFZSOkwQT9h6Z5oG4491 idD6USoyH8Z5Y1hqHcXQdTCG9dqo3oS38v5VLZODYMJ/kM63joZX3iDDD O0lCy2EXKzS+3OLEPDjXq1N4SeA6nvTVNqrfjJYkKKQAtRa2QXPFYlpEC g==; X-CSE-ConnectionGUID: e63MKMgyR1mDbpluKtNf0Q== X-CSE-MsgGUID: cS8vreOuSTKzYT+gAcw/uQ== X-IPAS-Result: A0CUAwAtn9Fq/4v/Ja1ahTB1YENJA5ZHA6AaDwEBAQ89FAQBAYUFAo4VAiY4EwECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBMCAQMyARgBLRAgMSsrGYMCAYJ0AxG8coIsgQGDKQE/AkNQ2zIBCxQBBYEzhUCII3UBhHwnGxuBcoR+gQWEC4V4BIIiehKBeJUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegmVaNCwEHIFlJwUMpWShDwoog3aMIpU6GjOqbwuYfY4Klk+EaYF/JYFZcBWDIglKGQ+OOYNrzlonMg4vAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:EqT6nKjWcZ4j7hvHKdYqv93IX161NhEKZh0ujC45NGQN5FlHY01je htvXz+GOPiLY2P2edx+Oduwp0sCsMLcnd83GgQ6/3hhRX5jpJueD7x1DKtf0wB+jyHnZBg6h ynLQoCYdKjYdleF+FHwdOCn8ikkvU2xbuKUIPbePSxsThNTRi4kiBZy88Y0mYcAbeKRW2thg vus5ZeAULOZ82QsaDxNs/vd8EoHUMna4Vv0gHRvPZing3eG/5UlJMp3Db28KXL+Xr5VEoaSL 87fzKu093/u5BwkDNWoiN7TKiXmlZaLYGBiIlIPM0STqkAqSh4ai87XB9JAAatjsAhlqvgqo Dl7WTNcfi9yVkHEsLx1vxC1iEiSN4UekFPMCSDXXcB+UyQqflO0q8iCAn3aMqUVpL1SIkRB5 MZBLRwHdhSepP6QzuqCH7wEasQLdKEHPasFsX1miDWcBvE8TNWbGePB5MRT23E7gcUm8fT2P pVCL2EwKk6dPlsWYQZ/5JEWxI9EglH/bz1Rq1uPjaE2+GPUigd21dABNfKIIYLTFJUPwB7wS mTu9F+pHAsXE8Gk9RmXw07vicbEgmTmYddHfFG/3rsw6LGJ/UQUEBAQWF6xrPW1h0L7UNVFJ mQQ+zEytu417EGtQ9z3UhG0rXLCuQQTM+e8CMUg4w2Lj66R6AGDCy1cFHhKaccts4k9QjlCO kK1ou4FzAdH6NW9IU9xPJ/Fxd9uEUD59VM/WBI= IronPort-HdrOrdr: A9a23:5oSZR69XN78NWKSjMbxuk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:22v8eWksaeIBe/jOZpJLAPVZ/VTXOXCDl1LzBkCpMz9sZLeNTUKz5IVqy/M7zg== X-Talos-MUID: 9a23:0xRazQXS1fheTdzq/DTX1C94OeB12JiNGnEx0povsNbDKBUlbg== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536198260" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id A67BB180000F5; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 08CBFCBEF98; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 07/10] openssh: Ignore CVE-2026-106589 Date: Thu, 15 Oct 2026 20:52:33 -0700 Message-Id: <20261016035236.442896-8-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247921 From: Hetvi Thakar Analysis: - This issue concerns platforms lacking file descriptor passing and unprivileged PTY allocation, notably QNX 6 and SCO OpenServer 5. - Wrynose builds OpenSSH for Linux, where the affected platform-specific configuration is not selected. Reference: https://ubuntu.com/security/CVE-2026-106589 Signed-off-by: Hetvi Thakar --- meta/recipes-connectivity/openssh/openssh_10.3p1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 6799e10b99..cd8b7169a8 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -57,6 +57,7 @@ CVE_STATUS[CVE-2026-3497] = "not-applicable-platform: Only affects GSSAPI Key Ex CVE_STATUS[CVE-2026-55653] = "not-applicable-platform: Only applies to RHEL FIPS patches." CVE_STATUS[CVE-2026-59998] = "${@bb.utils.contains('PACKAGECONFIG', 'kerberos', 'unpatched', 'not-applicable-config: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration', d)}" CVE_STATUS[CVE-2026-106588] = "not-applicable-platform: Requires the macOS 27 or later SDK and Darwin sandbox; Wrynose builds OpenSSH for Linux." +CVE_STATUS[CVE-2026-106589] = "not-applicable-platform: Requires platforms without file descriptor passing and unprivileged PTY allocation, such as QNX 6 or SCO OpenServer 5; Wrynose targets Linux." PAM_SRC_URI = "file://sshd" From patchwork Fri Oct 16 03:52:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100949 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5EBDCCA46D for ; Fri, 16 Oct 2026 03:52:44 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14418.1792122758622947280 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=jP7x/8G0; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2909; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=vao6Mv73d3WyGcbUVByNSr2Xh9wp6Edc4q1N3cIH3vY=; b=jP7x/8G0hdpW0Pw+VYzS+6JRz2NfVrAoX7AWWYE8UbpvHVUo3uDPJ8Pd 2hkrshY/K3As2JUQmxkeKpDZzER2bB5KMikgWkQPKYMJzxZkS/1kNrda0 YFbvnCw5aZbU8aRkhY0rTne6cmtk52w2qsiDOMXYrCR0QUVaVTpdBMs9z ugIgAV6SntIIkJaofOwsomtKMhexuFFkkVgNNZBG12IPuv7IYEis1Av7V OTrIsT5YDgXbcCDLWblHN89ToSg17yVwIsgvO9i5NJ4KbUisFbXeVCzpy w7TJtq5GXuuUA0r6XEYWzSDJGP/etPLVQdLih9GtyHNcjsuVfhJFS9Rt8 g==; X-CSE-ConnectionGUID: AfsPbhZLTk2gR2frddhkNQ== X-CSE-MsgGUID: veIpcpwzQ+O8qFS6baYfig== X-IPAS-Result: A0BIAgCwntFq/5H/Ja1aglmCV3VgQ0kDlkqeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMyARgBLRAcAwECFxgrIwgZgwIBgnQDEbxwgiyBAYMpAT8CQ1DbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAgOCJQULhW0EgiJ6EoFaHpUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegmWBDgErgiwcoziCIaEPCiiDdowilToaM6pvC5h9jgqWT4RpgWg8gVlwFYMiCUoZD445g2uFE8lHJzILAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:40vvNqJQHxe6Xnh5FE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENS1DJTy 2YfXzvSbPyJZjHyfNEgb9yy8EsBvsfczNdgTgod+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1HAloON40q3tp0W250r /ICJDwNbTa60rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBXbAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEmojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsiuG8b4eNI43iqcN9gEu5v mne4HbAQTZKLfKklzCMw3ytibqa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++Ms0CSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXJIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:F0Pe8KlTkRODth+KNYaZ9VhBjgjpDfL03DAbv31ZSRFFG/FwWf rAoB19726StN9/YhAdcLy7VZVoBEmsl6KdgrNhWYtKIjOHhILAFugLhuHfKn/bakjDH4Vmu5 uIHZITNDTYNykdsS+D2njaL/8QhP+a7auvmeDSi11pTQ1sduVcyj0RMHfjLqWzLzM2fqbQ0/ Gnl7J6mwY= X-Talos-CUID: 9a23:jDY/t2/W25rbCy2w6eqVv2caAfgvck/58HSKLHXiB3xlRL2Wb2bFrQ== X-Talos-MUID: 9a23:QOMIDA25HraX6RvqDVQbiM4KFDUj/amPEEsVjoc/+O7ULAJLZT2UvTq2Tdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="521975019" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id A9CC318000443; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 0C4BFCBEFAB; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 08/10] openssh: Fix CVE-2026-106583 Date: Thu, 15 Oct 2026 20:52:34 -0700 Message-Id: <20261016035236.442896-9-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247917 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. The two other commits linked by [2] only add and adjust regression tests; they contain no functional security fix. [1] https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 [2] https://ubuntu.com/security/CVE-2026-106583 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106583.patch | 35 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106583.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106583.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106583.patch new file mode 100644 index 0000000000..094f4bad63 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106583.patch @@ -0,0 +1,35 @@ +From 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2 Mon Sep 17 00:00:00 2001 +From: "dtucker@openbsd.org" +Date: Mon, 5 Oct 2026 06:03:40 +0000 +Subject: [PATCH] upstream: Further restrict the characters allowed in a command-line + +supplied user name, disallowing '$' and '\'. Reported by SecBuddyF KeenLab +Tencent (CodeBuddy Security). + +OpenBSD-Commit-ID: 13671c178f492af63b5c1296f284818c7809ed9a + +CVE: CVE-2026-106583 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2] + +Backport Changes: +- Omitted the upstream readconf.c OpenBSD revision-only hunk and retained + the Wrynose OpenSSH 10.3p1 revision. + +(cherry picked from commit 0c4c9a7b320bd7ff61c4a2dc345cb2e27e9663b2) +Signed-off-by: Hetvi Thakar +--- + readconf.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/readconf.c b/readconf.c +--- a/readconf.c ++++ b/readconf.c +@@ -3452 +3452 @@ ssh_valid_ruser(const char *s) +- if (strchr("'`\";&<>|(){}", s[i]) != NULL) ++ if (strchr("'`\";&<>|(){}$\\", s[i]) != NULL) +@@ -3457,3 +3457,0 @@ ssh_valid_ruser(const char *s) +- /* Disallow \ in last position */ +- if (s[i] == '\\' && s[i + 1] == '\0') +- return 0; +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index cd8b7169a8..4d9fd0c164 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -41,6 +41,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106587.patch \ file://CVE-2026-106582.patch \ file://CVE-2026-106585.patch \ + file://CVE-2026-106583.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100950 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9B16CCA473 for ; Fri, 16 Oct 2026 03:52:44 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14419.1792122758652496697 for ; Thu, 15 Oct 2026 20:52:38 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ZgJkRClj; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3721; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=eey1suPdeZI2ro+s2TPk6JuXjqhp907Qt9Um0PSuZ9Q=; b=ZgJkRCljFgG/vechZ7dXAjSdOkQj9UEIx1NgpvRm9GUpD/J2RC+Bm+m4 b86kDCUQ7AJ+IRhE8YoXDorHLK/uI4asbHDqxLSH5dBagGRuvBYL0VTDk sblmwkMf0HhYOlX+pb0JNWohrAfe4y9PP8ha0M3NGJDdC4GY1l08WofyK mgQUcGSfH3wxqBLlcf1Ae4KLDSVnLRMdRqDXAIfwpJ4C0L13L3lhTeEjV Ph4TThF03WQ8FQzqOICIlNx94oBwPkN+7ml6zocLnT4YE+J/h1gqvOYlQ MFkwE+uxjl77JFZE/rTZXfh+TSeitRgCmNNqFUu3MxrggKMUAXQfCXTKK w==; X-CSE-ConnectionGUID: JYojjdhPSAK6onnkUCp2Xg== X-CSE-MsgGUID: fxUJZk2PQaGn5eWSo9T6yA== X-IPAS-Result: A0AAAwAbntFq/4z/Ja1aglmCV3VgQ0kDlkcDnhyBfg8BAQEPRA0EAQGEP0YCjhUCJjYHDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDMgEYAS0QHAMBAi8rIwgQCYMCAYJ0AxG8HRs3giyBAYMpAT8CQ1DbMgELFAEFgTOFQIgjXRgBgkmCMycbG4FygRWDaYEFgVwCA4FFhl0EgiJ6EoFaHpUpSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWABEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegmV7EwErgiwGpW+hDwoog3aMIpU6GjOqbwuYfY4Klk+EaYFuATWBWXAVgyIJShkPjjmDa4UTyUcnMgsDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:6+CVzaJo+Kp1RN+qFE+Rh5QlxSXFcZb7ZxGr2PjKsXjdYENS3zVSn 2oXUTuCP63ZZWv9e9h/PI2xo0kG65TXmoRjTwYd+CA2RRqmiyZq6fd1j6vUF3nPRiEWZBs/t 63yUvGZcoZpCCea+Uf1WlTYhSEU/bmSQbbhA/LzNCl0RAt1IA8skhsLd9QR2uaEuvDnRVnS0 T/Oi5eHYgH8g2cqajt8B5+r8XuDgtyj4Fv0gXRmDRx7lAe2v2UYCpsZOZawIxPQKqFIHvS3T vr017qw+GXU5X8FUrtJRZ6iLyXm6paLVeS/oiI+t5qK23CulQRuukoPD8fwXG8M49m/c3+d/ /0W3XC4YV9B0qQhA43xWTEAe811FfUuFLMqvRFTvOTLp3AqfUcAzN1MPUY0P4EYwt1eIj9J8 /obFRsVNCCM0rfeLLKTEoGAh+w5J8XteYdasXZ6wHSBVrAtQIvIROPB4towMDUY358VW62BI ZBENHw2MEyojx5nYj/7DLo+gOehhXDlWzZZs1mS46Ew5gA/ySQsi+WwboqIK4biqcN9kFalh FDFpVzACz4cadGg8j3Uziy9r7qa9c/8cMdIfFGizdZtmFCVy2kZBREaWFf+qv6jh2a6WslDM AoT4icooK04+UCnQ9W7WAe3yENopTYGUNZWVul/4waXx++MuECSB3MPSXhKb9lOWNIKeAHGH 2Shx7vBbQGDepXPIZ5B3t94dQ+PBBU= IronPort-HdrOrdr: A9a23:T3qzyqsVBhSYSYN+1ev2VmBN7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:nlbHWWF77liZLAoHqmJFxUkWGMwlSkb07ynXJUm7NE1xEo2aHAo= X-Talos-MUID: 9a23:hd1Y1gsVl3M1RH3rts2niiFfFvVruZyXAW8LzJg5gM7VCXJhEmLI X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535568592" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id AAF8718000618; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 10869CBEFBF; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 09/10] openssh: Fix CVE-2026-106552 Date: Thu, 15 Oct 2026 20:52:35 -0700 Message-Id: <20261016035236.442896-10-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247918 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/openssh/openssh-portable/commit/c07ea2180adebd6019a6ebdd89becb9d9f4b4897 [2] https://ubuntu.com/security/CVE-2026-106552 Signed-off-by: Hetvi Thakar --- .../openssh/openssh/CVE-2026-106552.patch | 63 +++++++++++++++++++ .../openssh/openssh_10.3p1.bb | 1 + 2 files changed, 64 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch new file mode 100644 index 0000000000..a44d70a24f --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106552.patch @@ -0,0 +1,63 @@ +From c07ea2180adebd6019a6ebdd89becb9d9f4b4897 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Thu, 1 Oct 2026 03:11:49 +0000 +Subject: [PATCH] upstream: sftp: be stricter in accepting paths returned by the + +server for SSH_FXP_REALPATH or SSH2_FXP_READDIR replies, as these can be used +in some situations to decide the destination path for recursive transfers. + +Report and patch from Junghoon Cho + +OpenBSD-Commit-ID: ad357002a1b75c87113f01086a9f0c12c36082d8 + +CVE: CVE-2026-106552 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/c07ea2180adebd6019a6ebdd89becb9d9f4b4897] + +Backport Changes: +- Omitted upstream OpenBSD revision-only hunks and retained the Wrynose + OpenSSH 10.3p1 context. + +(cherry picked from commit c07ea2180adebd6019a6ebdd89becb9d9f4b4897) +Signed-off-by: Hetvi Thakar +--- + sftp-client.c | 3 ++- + sftp.c | 12 +++++++++--- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/sftp-client.c b/sftp-client.c +--- a/sftp-client.c ++++ b/sftp-client.c +@@ -785,7 +785,8 @@ sftp_lsreaddir(struct sftp_conn *conn, const char *path, + * These can be used to attack recursive ops + * (e.g. send '../../../../etc/passwd') + */ +- if (strpbrk(filename, SFTP_DIRECTORY_CHARS) != NULL) { ++ if (*filename == '\0' || ++ strpbrk(filename, SFTP_DIRECTORY_CHARS) != NULL) { + error("Server sent suspect path \"%s\" " + "during readdir of \"%s\"", filename, path); + } else if (dir) { +diff --git a/sftp.c b/sftp.c +--- a/sftp.c ++++ b/sftp.c +@@ -676,9 +676,15 @@ process_get(struct sftp_conn *conn, const char *src, const char *dst, + goto out; + } + +- /* Special handling for dest of '..' */ +- if (strcmp(filename, "..") == 0) +- filename = "."; /* Download to dest, not dest/.. */ ++ /* ++ * Special handling for destinations of '..' and remote roots. ++ * In particular, never select the local root as an implicit ++ * destination for a remote root. ++ */ ++ if (strcmp(filename, "..") == 0 || ++ (filename[0] != '\0' && ++ filename[strspn(filename, "/")] == '\0')) ++ filename = "."; + + if (g.gl_matchc == 1 && dst) { + if (local_is_dir(dst)) { +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index 4d9fd0c164..a2a5a3b924 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -42,6 +42,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106582.patch \ file://CVE-2026-106585.patch \ file://CVE-2026-106583.patch \ + file://CVE-2026-106552.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4" From patchwork Fri Oct 16 03:52:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 100953 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFB7ACCA46C for ; Fri, 16 Oct 2026 03:52:44 +0000 (UTC) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.14417.1792122758616888354 for ; Thu, 15 Oct 2026 20:52:39 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=a8+1W4FV; spf=pass (domain: cisco.com, ip: 173.37.86.74, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=10025; q=dns/txt; s=iport01; t=1792122758; x=1793332358; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=8YHDoxha92fmDuzPCQpJ6I95bi5HmWuXef5DT5ZOTkQ=; b=a8+1W4FVNYCufOVCkydlN7cIiEmip3dx3pQCTk1jDdpaKC4aOPDBJHW3 BsRvfovj/cyeI5MfxqydGcKPieihEjT9NYVIcP4G+YZlKUbRU5MQMEhjw 4eDir910sWfMfiQkFgQC7bH4TQ0J3+rXDCa759ImINhPSAWpuQXmG1h+C DPwGIgJSqmBWqRnQb8zeKhTdpedPZfVpJr5pS5XRv4ITyZ3VQay2BHHLt AdHxuJy2i1GbN6bJG752HZmS1dz++b0UqPiE7ouAv+Xk8yiV/x1Due59T Fp1ojwwRtp82ig+MdZtZQJ7RW0wrROxf8Kgdn5CIHmRGAFTlYtMve3qdl w==; X-CSE-ConnectionGUID: D/CGuEg4SyOV3qdz7MyHBw== X-CSE-MsgGUID: XjLMxtBPT3e33cfJkgJlBQ== X-IPAS-Result: A0DMAgCwntFq/5H/Ja1aglmCV3VgQ0kDlkcDnhwUgWoPAQEBD0QNBAEBhD9GAo4VAiY1CA4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAycLARgBLRAcAwECLysjCBmDAgGCdAMRvHCBeTOBAYMpAT8CQ1DbMgELFAEFgTOFQIgjXRgBhHwnGxuBcoEVg2mBBYFcAgOBRIZeBIINFXoSgVoehHCQOUiBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylgARAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoIvNlAKNAErIIIMCgUNoziCIaEPCiiDdowilToaM6pvC5h9jgqVNU1NhGmBagE5gVlwFYMiCUoZD44uCwuDYIUTyUcnMgsDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:+DL+l6umScfyBYYGJ/uZfGmO0efnVABfMUV32f8akzHdYApBsoF/q tZmKT+DOPvbamD0fNByPd609EkPvpfTm9I3GgRrry0wQSIbgMeUXt7xwmUckM+xwmwvaGo9s q3yv/GZdJhcokf0/0nrb/656yYsjclkf5KkYMbcICd9WAR4fykojBNnioYRj5Vh6TSDK1vlV eja/YuFZzdJ5xYuajhKsvra9ks21BjPkGpwUmIWNKgjUGD2zxH5PLpHTYmtIn3xRJVjH+LSb 47r0LGj82rFyAwmA9Wjn6yTWhVirmn6ZFXmZtJ+AsBOszAazsAA+v9T2Mk0NS+7vw60c+VZk 72hg3AfpTABZcUgkMxFO/VR/roX0aduoNcrKlDn2SCfItGvn3bEm51T4E8K0YIw1qFcLnxj+ qAjORczNQmPlb2T0ZKRVbw57igjBJGD0II3oHpsy3TdSP0hW52GG/WM7t5D1zB2jcdLdRrcT 5NGMnw0M1KaPkAJYwtKYH49tL/Aan3XcyFYoVGcv4I84nPYy0p6172F3N/9J4fUG5oFwBzEz o7A11T7JjQKKPan9WGIqSmniM3MkgH/crtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHtlYM UE8/is1sbN081SmSNT4VRC0rHOI+BkGVLJt//YS8gqBzO/Qpg2eHGVBFm4HY909v8hwTjsvv rOUo+7U6fVUmOX9YRqgGn2891te5QB9wbc+WBI5 IronPort-HdrOrdr: A9a23:03+CVa6j+xqQn9LEHQPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:Bx0U9mlNuqhMZ8vJwbcOMUw/tDLXOVGa51jNDkDkMndOduaMRU3P3bJEudU7zg== X-Talos-MUID: 9a23:xzTYCA4xLpVky8fvCGegm4fdxoxY4YCLGFwnqaldtpLfPiJSODi/iB6OF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536678624" Received: from rcdn-l-core-08.cisco.com ([173.37.255.145]) by rcdn-iport-3.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 03:52:37 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-08.cisco.com (Postfix) with ESMTPS id AC1BB1800047E; Fri, 16 Oct 2026 03:52:37 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 14DF1CBEF6B; Thu, 15 Oct 2026 20:52:37 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-core@lists.openembedded.org Cc: xe-linux-external@cisco.com Subject: [OE-core][wrynose][PATCH 10/10] openssh: Fix CVE-2026-106553 and CVE-2026-106555 Date: Thu, 15 Oct 2026 20:52:36 -0700 Message-Id: <20261016035236.442896-11-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016035236.442896-1-hthakar@cisco.com> References: <20261016035236.442896-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: rcdn-l-core-08.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 03:52:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247920 From: Hetvi Thakar This patch applies the shared upstream fixes referenced in [4] and [5], using the commits shown in [1], [2], and [3]. [1] https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0 [2] https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7 [3] https://github.com/openssh/openssh-portable/commit/d549f99da344c178c5f632a62a6aa60544d7236e [4] https://ubuntu.com/security/CVE-2026-106553 [5] https://ubuntu.com/security/CVE-2026-106555 Signed-off-by: Hetvi Thakar --- .../CVE-2026-106553_CVE-2026-106555_p1.patch | 100 ++++++++++++++++++ .../CVE-2026-106553_CVE-2026-106555_p2.patch | 80 ++++++++++++++ .../CVE-2026-106553_CVE-2026-106555_p3.patch | 42 ++++++++ .../openssh/openssh_10.3p1.bb | 3 + 4 files changed, 225 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch new file mode 100644 index 0000000000..b27d31d3c9 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p1.patch @@ -0,0 +1,100 @@ +From 670510d1e190b0f4e47066f24498c04ada1da0f0 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:37:07 +0000 +Subject: [PATCH] upstream: Reset GSSAPI client state before authentication + +Avoids situation where a partially-completed GSSAPI authentication attempt +can retain state that is subsequently used by a later attempt. + +Report and feedback Moritz Theile, also reported by several others. + +ok markus, deraadt + +OpenBSD-Commit-ID: 95758f23e358b7c19e6205ac1c979193a9145556 + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/670510d1e190b0f4e47066f24498c04ada1da0f0] + +Backport Changes: +- Omit upstream OpenBSD revision-only hunks. + +(cherry picked from commit 670510d1e190b0f4e47066f24498c04ada1da0f0) +Signed-off-by: Hetvi Thakar +--- + auth2.c | 1 + + gss-serv.c | 19 ++++++++++++------- + monitor.c | 2 ++ + ssh-gss.h | 1 + + 4 files changed, 16 insertions(+), 7 deletions(-) + +diff --git a/auth2.c b/auth2.c +--- a/auth2.c ++++ b/auth2.c +@@ -338,3 +338,4 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh) + #ifdef GSSAPI ++ ssh_gssapi_cleanup_global_client(); + /* XXX move to auth2_gssapi_stop() */ + ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -361,12 +361,21 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) + } + } + ++void ++ssh_gssapi_cleanup_global_client() ++{ ++ OM_uint32 lmin; ++ ++ gss_release_buffer(&lmin, &gssapi_client.displayname); ++ gss_release_buffer(&lmin, &gssapi_client.exportedname); ++ gss_release_cred(&lmin, &gssapi_client.creds); ++ explicit_bzero(&gssapi_client, sizeof(ssh_gssapi_client)); ++} ++ + /* Privileged */ + int + ssh_gssapi_userok(char *user) + { +- OM_uint32 lmin; +- + if (gssapi_client.exportedname.length == 0 || + gssapi_client.exportedname.value == NULL) { + debug("No suitable client data"); +@@ -377,11 +386,7 @@ ssh_gssapi_userok(char *user) + return 1; + else { + /* Destroy delegated credentials if userok fails */ +- gss_release_buffer(&lmin, &gssapi_client.displayname); +- gss_release_buffer(&lmin, &gssapi_client.exportedname); +- gss_release_cred(&lmin, &gssapi_client.creds); +- explicit_bzero(&gssapi_client, +- sizeof(ssh_gssapi_client)); ++ ssh_gssapi_cleanup_global_client(); + return 0; + } + else +diff --git a/monitor.c b/monitor.c +--- a/monitor.c ++++ b/monitor.c +@@ -1990,6 +1990,8 @@ mm_answer_gss_setup_ctx(struct ssh *ssh, int sock, struct sshbuf *m) + if (!options.gss_authentication) + fatal_f("GSSAPI authentication not enabled"); + ++ ssh_gssapi_cleanup_global_client(); ++ + if ((r = sshbuf_get_string(m, &p, &len)) != 0) + fatal_fr(r, "parse"); + goid.elements = p; +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -132,4 +132,5 @@ void ssh_gssapi_cleanup_creds(void); + void ssh_gssapi_storecreds(void); + const char *ssh_gssapi_displayname(void); ++void ssh_gssapi_cleanup_global_client(); + + #endif /* GSSAPI */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch new file mode 100644 index 0000000000..02b7d7661a --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p2.patch @@ -0,0 +1,80 @@ +From 6f9cd19af05aa828d7778cfb047faaed1679e8b7 Mon Sep 17 00:00:00 2001 +From: "djm@openbsd.org" +Date: Wed, 16 Sep 2026 00:37:52 +0000 +Subject: [PATCH] upstream: Only store GSSAPI creds when authn succeeds + +Issue report and patch from Moritz Theile + +ok markus, deraadt + +OpenBSD-Commit-ID: 812bbd22b8dd5a1583094ab2b6ff0045e4088467 + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6f9cd19af05aa828d7778cfb047faaed1679e8b7] + +Backport Changes: +- Omit upstream OpenBSD revision-only hunks. + +(cherry picked from commit 6f9cd19af05aa828d7778cfb047faaed1679e8b7) +Signed-off-by: Hetvi Thakar +--- + gss-serv.c | 13 ++++++++++--- + ssh-gss.h | 1 + + 2 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -52,7 +52,7 @@ extern ServerOptions options; + + static ssh_gssapi_client gssapi_client = + { GSS_C_EMPTY_BUFFER, GSS_C_EMPTY_BUFFER, +- GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}}; ++ GSS_C_NO_CREDENTIAL, NULL, {NULL, NULL, NULL, NULL}, 0}; + + ssh_gssapi_mech gssapi_null_mech = + { NULL, NULL, {0, NULL}, NULL, NULL, NULL, NULL}; +@@ -281,6 +281,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, ssh_gssapi_client *client) + + gss_buffer_desc ename; + ++ client->userok = 0; + client->mech = NULL; + + while (supported_mechs[i]->name != NULL) { +@@ -332,4 +333,9 @@ ssh_gssapi_storecreds(void) + { ++ if (!gssapi_client.userok) { ++ debug_f("GSSAPI client was not authorized, doing nothing"); ++ return; ++ } ++ + if (options.gss_deleg_creds == 0) { + debug_f("delegate credential is disabled, doing nothing"); + return; +@@ -382,9 +388,10 @@ ssh_gssapi_userok(char *user) + } + if (gssapi_client.mech && gssapi_client.mech->userok) +- if ((*gssapi_client.mech->userok)(&gssapi_client, user)) ++ if ((*gssapi_client.mech->userok)(&gssapi_client, user)) { ++ gssapi_client.userok = 1; + return 1; +- else { ++ } else { + /* Destroy delegated credentials if userok fails */ + ssh_gssapi_cleanup_global_client(); + return 0; + } +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -72,6 +72,7 @@ typedef struct { + gss_cred_id_t creds; + struct ssh_gssapi_mech_struct *mech; + ssh_gssapi_ccache store; ++ int userok; + } ssh_gssapi_client; + + typedef struct ssh_gssapi_mech_struct { +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch new file mode 100644 index 0000000000..0d40de214b --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-106553_CVE-2026-106555_p3.patch @@ -0,0 +1,42 @@ +From d549f99da344c178c5f632a62a6aa60544d7236e Mon Sep 17 00:00:00 2001 +From: "robert@openbsd.org" +Subject: [PATCH] upstream: ssh_gssapi_cleanup_global_client() needs a prototype + +CVE: CVE-2026-106553 CVE-2026-106555 +Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d549f99da344c178c5f632a62a6aa60544d7236e] + +Backport Changes: +- Retain the Wrynose 10.3p1 context and omit upstream OpenBSD revision-only + hunks. + +(cherry picked from commit d549f99da344c178c5f632a62a6aa60544d7236e) +Signed-off-by: Hetvi Thakar +--- + gss-serv.c | 2 +- + ssh-gss.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/gss-serv.c b/gss-serv.c +--- a/gss-serv.c ++++ b/gss-serv.c +@@ -368,7 +368,7 @@ ssh_gssapi_do_child(char ***envp, u_int *envsizep) + } + + void +-ssh_gssapi_cleanup_global_client() ++ssh_gssapi_cleanup_global_client(void) + { + OM_uint32 lmin; + +diff --git a/ssh-gss.h b/ssh-gss.h +--- a/ssh-gss.h ++++ b/ssh-gss.h +@@ -133,5 +133,5 @@ void ssh_gssapi_cleanup_creds(void); + void ssh_gssapi_storecreds(void); + const char *ssh_gssapi_displayname(void); +-void ssh_gssapi_cleanup_global_client(); ++void ssh_gssapi_cleanup_global_client(void); + + #endif /* GSSAPI */ +-- +2.43.0 diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb index a2a5a3b924..925b22e129 100644 --- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb +++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb @@ -43,6 +43,9 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta file://CVE-2026-106585.patch \ file://CVE-2026-106583.patch \ file://CVE-2026-106552.patch \ + file://CVE-2026-106553_CVE-2026-106555_p1.patch \ + file://CVE-2026-106553_CVE-2026-106555_p2.patch \ + file://CVE-2026-106553_CVE-2026-106555_p3.patch \ " SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"