mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-12 06:49:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

libssh2: fix CVE-2026-66035

Browse Source 
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-66035
42e33d8157

libssh2 ptest results (qemux86-64):
  before: PASSED: 1 FAILED: 0 SKIPPED: 0
  after:  PASSED: 1 FAILED: 0 SKIPPED: 0

(From OE-Core rev: e0e829a80e9d8a736c41594c0fe7d4fddca9f0b4)

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Jaipaul Cheernam
2026-08-04 15:09:46 +02:00
committed by Paul Barker
parent 001428f528
commit b28d0cf59a
2 changed files with 57 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
meta/recipes-support/libssh2/libssh2/CVE-2026-66035.patch Normal file
View File

@@ -0,0 +1,56 @@
From 6671019836476649792eea12868a370133be1abe Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 3 Jul 2026 18:22:55 +0200
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-6c79-444r-wx26
Closes #2198
Backport adaptations:
- The upstream fix uses SSH2_SAFEFREE() to safely release allocated
memory and reset the pointer. Since SSH2_SAFEFREE() is not available
in libssh2 1.11.1, replace its usage with the equivalent NULL check,
LIBSSH2_FREE(), and pointer reset sequence.
- The upstream fix renames decrypt() to transport_decrypt(). Since this
rename is not present in libssh2 1.11.1, retain the original
decrypt() function name.
CVE: CVE-2026-66035
Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
src/transport.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/src/transport.c b/src/transport.c
index d147505b..9f386e75 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -242,6 +242,17 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
unsigned char *decrypt_buffer;
int blocksize = session->remote.crypt->blocksize;
+ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+ if(p->payload) {
+ LIBSSH2_FREE(session, p->payload);
+ p->payload = NULL;
+ }
+ return LIBSSH2_ERROR_DECRYPT;
+ }
+ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
+ first_block[0] = 0;
+
rc = decrypt(session, p->payload + 4,
first_block, blocksize, FIRST_BLOCK);
if(rc) {
@@ -249,7 +260,6 @@ fullpacket(LIBSSH2_SESSION * session, int encrypted /* 1 or 0 */ )
}
/* we need buffer for decrypt */
- decrypt_size = p->total_num - mac_len - 4;
decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
if(!decrypt_buffer) {
return LIBSSH2_ERROR_ALLOC;

1
meta/recipes-support/libssh2/libssh2_1.11.1.bb
View File

@@ -19,6 +19,7 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2026-66032.patch \
file://CVE-2026-66033.patch \
file://CVE-2026-66034.patch \
file://CVE-2026-66035.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"