mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libssh2: fix CVE-2026-66035

Browse Source 
Backport the fix for CVE-2026-66035.

The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Stefan Müller
2026-08-20 07:32:08 +00:00
committed by Julien Olivain
parent 58581deeca
commit 03757abfce
2 changed files with 45 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch Normal file
View File

@@ -0,0 +1,42 @@
From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
From: Viktor Szakats <commit@vsz.me>
Date: Fri, 3 Jul 2026 18:22:55 +0200
Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
Reported-by: Vladimir Eli Tokarev
Fixes GHSA-6c79-444r-wx26
Closes #2198
Forwarded: not-needed
CVE: CVE-2026-66035
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66035.patch/
Upstream: https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
---
src/transport.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/src/transport.c
+++ b/src/transport.c
@@ -242,6 +242,12 @@
unsigned char *decrypt_buffer;
int blocksize = session->remote.crypt->blocksize;
+ if(p->total_num < mac_len + 4 + (size_t)blocksize) {
+ LIBSSH2_FREE(session, p->payload);
+ return LIBSSH2_ERROR_DECRYPT;
+ }
+ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
+
rc = decrypt(session, p->payload + 4,
first_block, blocksize, FIRST_BLOCK);
if(rc) {
@@ -249,7 +255,6 @@
}
/* we need buffer for decrypt */
- decrypt_size = p->total_num - mac_len - 4;
decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
if(!decrypt_buffer) {
return LIBSSH2_ERROR_ALLOC;

3
package/libssh2/libssh2.mk
View File

@@ -36,6 +36,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66033
# 0009-publickey-fix-potential-OOB-read.patch
LIBSSH2_IGNORE_CVES += CVE-2026-66034
# 0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch
LIBSSH2_IGNORE_CVES += CVE-2026-66035
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
LIBSSH2_DEPENDENCIES += mbedtls
LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \