From 6a04d44b078512270f6dad04e3cb0623a87bfd2d Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 30 Jun 2026 21:42:00 +0200 Subject: [PATCH] package/libssh2: backport upstream patch for CVE-2026-55200 - CVE-2026-55200: libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of- bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-55200 - https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Signed-off-by: Thomas Perale Signed-off-by: Fiona Klute (cherry picked from commit c5aa9327458fceb21e0278f37765af1d5175e1cf) Signed-off-by: Thomas Perale --- ...al-boundary-checks-for-packet-length.patch | 36 +++++++++++++++++++ package/libssh2/libssh2.mk | 3 ++ 2 files changed, 39 insertions(+) create mode 100644 package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch diff --git a/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch b/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch new file mode 100644 index 0000000000..ef54771afc --- /dev/null +++ b/package/libssh2/0003-transport-c-Additional-boundary-checks-for-packet-length.patch @@ -0,0 +1,36 @@ +From 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 Mon Sep 17 00:00:00 2001 +From: Will Cosgrove +Date: Fri, 12 Jun 2026 15:57:44 -0700 +Subject: [PATCH] transport.c: Additional boundary checks for packet length + (#2052) + +Add additional bounds checking on packet length to prevent OOB write. + +Credit: [TristanInSec](https://github.com/TristanInSec) + +CVE: CVE-2026-55200 +Upstream: https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8 +[thomas: backport to 1.11.1, change ntohu32 call] +Signed-off-by: Thomas Perale +--- + src/transport.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/src/transport.c b/src/transport.c +index 869fc5a4fa..7925ad33d1 100644 +--- a/src/transport.c ++++ b/src/transport.c +@@ -645,8 +645,12 @@ int ssh2_transport_read(LIBSSH2_SESSION *session) + total_num = 4; + + p->packet_length = _libssh2_ntohu32(block); +- if(p->packet_length < 1) ++ if(p->packet_length < 1) { + return LIBSSH2_ERROR_DECRYPT; ++ } ++ else if(p->packet_length > LIBSSH2_PACKET_MAXPAYLOAD) { ++ return LIBSSH2_ERROR_OUT_OF_BOUNDARY; ++ } + + /* total_num may include size field, however due to existing + * logic it needs to be removed after the entire packet is read diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk index c85129a7cd..0ccf5effb3 100644 --- a/package/libssh2/libssh2.mk +++ b/package/libssh2/libssh2.mk @@ -19,6 +19,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-7598 # 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch LIBSSH2_IGNORE_CVES += CVE-2026-55199 +# 0003-transport-c-Additional-boundary-checks-for-packet-length.patch +LIBSSH2_IGNORE_CVES += CVE-2026-55200 + ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y) LIBSSH2_DEPENDENCIES += mbedtls LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \