From: Deepak Rathore <[email protected]> Pick the patch [1] and [2] as mentioned in [3]
[1] https://git.libssh.org/projects/libssh.git/commit/?id=f80670a7aba86cbb442c9b115c9eaf4ca04601b8 [2] https://git.libssh.org/projects/libssh.git/commit/?id=02c6f5f7ec8629a7cff6a28cde9701ab10304540 [3] https://security-tracker.debian.org/tracker/CVE-2026-3731 Signed-off-by: Deepak Rathore <[email protected]> --- Changes from v1 to v2: - Update the commit message. - Cherry pick it from libssh-0.11.4 release tag and add the second patch to add the reproducer for the CVE. diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p1.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p1.patch new file mode 100644 index 0000000000..bf1fbcc027 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p1.patch @@ -0,0 +1,35 @@ +From 04d2f831fa8da74c973538cd3f621061a7656771 Mon Sep 17 00:00:00 2001 +From: Jakub Jelen <[email protected]> +Date: Thu, 11 Dec 2025 13:22:44 +0100 +Subject: [PATCH 1/2] sftp: Fix out-of-bound read from sftp extensions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE: CVE-2026-3731 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=f80670a7aba86cbb442c9b115c9eaf4ca04601b8] + +Signed-off-by: Jakub Jelen <[email protected]> +Reviewed-by: Pavol Žáčik <[email protected]> +(cherry picked from commit 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60) +(cherry picked from commit f80670a7aba86cbb442c9b115c9eaf4ca04601b8) +Signed-off-by: Deepak Rathore <[email protected]> +--- + src/sftp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sftp.c b/src/sftp.c +index 37b4133b..05e05019 100644 +--- a/src/sftp.c ++++ b/src/sftp.c +@@ -583,7 +583,7 @@ const char *sftp_extensions_get_name(sftp_session sftp, unsigned int idx) { + return NULL; + } + +- if (idx > sftp->ext->count) { ++ if (idx >= sftp->ext->count) { + ssh_set_error_invalid(sftp->session); + return NULL; + } +-- +2.35.6 diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p2.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p2.patch new file mode 100644 index 0000000000..b5a267b808 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2026-3731_p2.patch @@ -0,0 +1,102 @@ +From df01168bb3863306ba0f35b50e5b2e5dd00ba9f6 Mon Sep 17 00:00:00 2001 +From: Jakub Jelen <[email protected]> +Date: Thu, 11 Dec 2025 13:21:23 +0100 +Subject: [PATCH 2/2] Reproducer for out of bounds read of SFTP extensions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE: CVE-2026-3731 +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=02c6f5f7ec8629a7cff6a28cde9701ab10304540] + +Signed-off-by: Jakub Jelen <[email protected]> +Reviewed-by: Pavol Žáčik <[email protected]> +(cherry picked from commit b90b7f24517efa7ab21506db9379aa3dce9fee7d) +(cherry picked from commit 02c6f5f7ec8629a7cff6a28cde9701ab10304540) +Signed-off-by: Deepak Rathore <[email protected]> +--- + tests/client/torture_sftp_init.c | 62 +++++++++++++++++++++++++++++++- + 1 file changed, 61 insertions(+), 1 deletion(-) + +diff --git a/tests/client/torture_sftp_init.c b/tests/client/torture_sftp_init.c +index a17f01fe..cdc24426 100644 +--- a/tests/client/torture_sftp_init.c ++++ b/tests/client/torture_sftp_init.c +@@ -72,6 +72,63 @@ static void session_setup_channel(void **state) + assert_non_null(s->ssh.tsftp); + } + ++static void session_setup_extensions(void **state) ++{ ++ struct torture_state *s = *state; ++ struct passwd *pwd = NULL; ++ int rc, count; ++ const char *name = NULL, *data = NULL; ++ sftp_session sftp = NULL; ++ ++ pwd = getpwnam("bob"); ++ assert_non_null(pwd); ++ ++ rc = setuid(pwd->pw_uid); ++ assert_return_code(rc, errno); ++ ++ s->ssh.session = torture_ssh_session(s, ++ TORTURE_SSH_SERVER, ++ NULL, ++ TORTURE_SSH_USER_ALICE, ++ NULL); ++ assert_non_null(s->ssh.session); ++ ++ s->ssh.tsftp = torture_sftp_session(s->ssh.session); ++ assert_non_null(s->ssh.tsftp); ++ sftp = s->ssh.tsftp->sftp; ++ ++ /* null parameter */ ++ count = sftp_extensions_get_count(NULL); ++ assert_int_equal(count, 0); ++ ++ count = sftp_extensions_get_count(sftp); ++ assert_int_not_equal(count, 0); ++ ++ /* first null parameter */ ++ name = sftp_extensions_get_name(NULL, 0); ++ assert_null(name); ++ data = sftp_extensions_get_data(NULL, 0); ++ assert_null(data); ++ ++ /* First extension */ ++ name = sftp_extensions_get_name(sftp, 0); ++ assert_non_null(name); ++ data = sftp_extensions_get_data(sftp, 0); ++ assert_non_null(data); ++ ++ /* Last extension */ ++ name = sftp_extensions_get_name(sftp, count - 1); ++ assert_non_null(name); ++ data = sftp_extensions_get_data(sftp, count - 1); ++ assert_non_null(data); ++ ++ /* Overrun */ ++ name = sftp_extensions_get_name(sftp, count); ++ assert_null(name); ++ data = sftp_extensions_get_data(sftp, count); ++ assert_null(data); ++} ++ + static int session_teardown(void **state) + { + struct torture_state *s = *state; +@@ -92,7 +149,10 @@ int torture_run_tests(void) { + session_teardown), + cmocka_unit_test_setup_teardown(session_setup_channel, + NULL, +- session_teardown) ++ session_teardown), ++ cmocka_unit_test_setup_teardown(session_setup_extensions, ++ NULL, ++ session_teardown), + }; + + ssh_init(); +-- +2.35.6 diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb index 5928581312..ab47931fa3 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.11.3.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.11.3.bb @@ -9,6 +9,8 @@ DEPENDS = "zlib openssl" SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable-0.11;tag=${BPN}-${PV} \ file://0001-tests-CMakeLists.txt-do-not-search-ssh-sshd-commands.patch \ file://run-ptest \ + file://CVE-2026-3731_p1.patch \ + file://CVE-2026-3731_p2.patch \ " SRC_URI:append:toolchain-clang = " file://0001-CompilerChecks.cmake-drop-Wunused-variable-flag.patch" -- 2.35.6
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#125081): https://lists.openembedded.org/g/openembedded-devel/message/125081 Mute This Topic: https://lists.openembedded.org/mt/118257651/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
