mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-26 20:10:35 -09:00
58581deeca
Backport the fix for CVE-2026-66034. The publickey subsystem does not sufficiently validate the length of a server-controlled comment field. A malformed response can therefore cause an out-of-bounds read. Use Debian's libssh2 1.11.1 backport of the upstream fix. Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com> [Julien: add links to Debian patches] Signed-off-by: Julien Olivain <ju.o@free.fr>
37 lines
1.2 KiB
Diff
37 lines
1.2 KiB
Diff
From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
|
|
From: Viktor Szakats <commit@vsz.me>
|
|
Date: Sat, 4 Jul 2026 11:19:49 +0200
|
|
Subject: [PATCH] publickey: fix potential OOB read in
|
|
`libssh2_publickey_list_fetch()`
|
|
|
|
Reported-by: Vladimir Eli Tokarev
|
|
Fixes GHSA-w6g9-cpfp-22gc
|
|
|
|
Closes #2202
|
|
Forwarded: not-needed
|
|
|
|
CVE: CVE-2026-66034
|
|
Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66034.patch/
|
|
Upstream: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
|
|
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
|
|
---
|
|
src/publickey.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
--- a/src/publickey.c
|
|
+++ b/src/publickey.c
|
|
@@ -988,6 +988,13 @@
|
|
}
|
|
|
|
if(comment_len) {
|
|
+ if(pkey->listFetch_s + comment_len >
|
|
+ pkey->listFetch_data + pkey->listFetch_data_len) {
|
|
+ _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
|
|
+ "ListFetch data too short");
|
|
+ goto err_exit;
|
|
+ }
|
|
+
|
|
list[keys].num_attrs = 1;
|
|
list[keys].attrs =
|
|
LIBSSH2_ALLOC(session,
|