mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-26 12:00:48 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libssh2: fix CVE-2026-66032

Browse Source 
Backport the fix for CVE-2026-66032.

A SFTP error path can leave a dangling pointer after freeing the
response buffer, which may result in a double free on subsequent error
handling.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit is contained in:
Stefan Müller
2026-08-20 07:32:05 +00:00
committed by Julien Olivain
parent 546fd31c70
commit 05c13e87e9
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
package/libssh2/0007-sftp-prevent-dangling-pointer-after-free.patch Normal file
View File

@@ -0,0 +1,29 @@
From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Thu, 2 Jul 2026 11:00:23 -0700
Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
Set data to NULL after freeing it to avoid dangling pointer. fixes
GHSA-px3w-7g75-hg7w.
Credit: VladimirEliTokarev
Forwarded: not-needed
CVE: CVE-2026-66032
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66032.patch/
Upstream: https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
---
src/sftp.c | 1 +
1 file changed, 1 insertion(+)
--- a/src/sftp.c
+++ b/src/sftp.c
@@ -1279,6 +1279,7 @@
"got HANDLE FXOK"));
LIBSSH2_FREE(session, data);
+ data = NULL;
/* silly situation, but check for a HANDLE */
rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,

3
package/libssh2/libssh2.mk
View File

@@ -27,6 +27,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-55200
# 0006-sftp-symlink-fix-SSH_FXP_STATUS-response.patch
LIBSSH2_IGNORE_CVES += CVE-2025-15661
# 0007-sftp-prevent-dangling-pointer-after-free.patch
LIBSSH2_IGNORE_CVES += CVE-2026-66032
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
LIBSSH2_DEPENDENCIES += mbedtls
LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \