From 3313c4f10e557d792c19b07d4eecd4246dcd37c7 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Jun 2026 21:41:59 +0200 Subject: [PATCH] package/libssh2: add upstream patch for CVE-2026-55199 Fixes the following vulnerability: - CVE-2026-55199: libssh2 through 1.11.1, fixed in commit 1762685, contains a pre- authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-55199 - https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4 Signed-off-by: Thomas Perale Signed-off-by: Fiona Klute (cherry picked from commit 3c8cfad8045a2b731177e6f9b150b065980410b5) Signed-off-by: Thomas Perale --- ...et-string-return-in-EXT-INFO-handler.patch | 43 +++++++++++++++++++ package/libssh2/libssh2.mk | 3 ++ 2 files changed, 46 insertions(+) create mode 100644 package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch diff --git a/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch new file mode 100644 index 0000000000..c7319a6b51 --- /dev/null +++ b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch @@ -0,0 +1,43 @@ +From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001 +From: TristanInSec +Date: Wed, 15 Apr 2026 14:51:08 -0400 +Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO` + handler + +The `SSH_MSG_EXT_INFO` handler discards the return values from +`_libssh2_get_string()` when parsing extension name/value pairs. When +the buffer is exhausted before all claimed extensions are parsed, +the loop continues with no-op iterations until `nr_extensions` reaches +zero. + +The `nr_extensions >= 1024` cap limits the worst case, but the loop +should still break on parse failure for correctness and consistency +with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`, +`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values. + +Closes #1864 + +CVE: CVE-2026-55199 +Upstream: https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4 +Signed-off-by: Thomas Perale +--- + src/packet.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/packet.c b/src/packet.c +index ae86365d2a..8a7a0d2690 100644 +--- a/src/packet.c ++++ b/src/packet.c +@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data, + + nr_extensions -= 1; + +- _libssh2_get_string(&buf, &name, &name_len); +- _libssh2_get_string(&buf, &value, &value_len); ++ if(_libssh2_get_string(&buf, &name, &name_len)) ++ break; ++ if(_libssh2_get_string(&buf, &value, &value_len)) ++ break; + + if(name && value) { + _libssh2_debug((session, diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk index 1843d25051..c85129a7cd 100644 --- a/package/libssh2/libssh2.mk +++ b/package/libssh2/libssh2.mk @@ -16,6 +16,9 @@ LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath # 0001-username-len-bound-checking.patch LIBSSH2_IGNORE_CVES += CVE-2026-7598 +# 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch +LIBSSH2_IGNORE_CVES += CVE-2026-55199 + ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y) LIBSSH2_DEPENDENCIES += mbedtls LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \