mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 00:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libssh2: add upstream security patch for CVE-2026-7598

Browse Source 
This commit fixes the following vulnerability:

- CVE-2026-7598:
    A security vulnerability has been detected in libssh2 up to 1.11.1.
    The impacted element is the function userauth_password of the file
    src/userauth.c. Such manipulation of the argument
    username_len/password_len leads to integer overflow. The attack may be
    launched remotely. The name of the patch is
    256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to
    remediate this issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-7598
  - 256d04b60d

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 061d6b121b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-06-02 22:22:45 +02:00
parent 676d275250
commit b19ea523d6
2 changed files with 60 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
package/libssh2/0001-username-len-bound-checking.patch Normal file
View File

@@ -0,0 +1,57 @@
From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
From: Will Cosgrove <will@panic.com>
Date: Mon, 13 Apr 2026 11:18:25 -0700
Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
Return errors when username_len will exceed bounds, fix existing bounds
check.
Credit:
[dapickle](https://github.com/dapickle)
CVE: CVE-2026-7598
Upstream: https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
src/userauth.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/src/userauth.c b/src/userauth.c
index f8e02651..43d9ab9b 100644
--- a/src/userauth.c
+++ b/src/userauth.c
@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
memset(&session->userauth_list_packet_requirev_state, 0,
sizeof(session->userauth_list_packet_requirev_state));
+ if(username_len > UINT32_MAX - 27) {
+ _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+ "username_len out of bounds");
+ return NULL;
+ }
+
session->userauth_list_data_len = username_len + 27;
s = session->userauth_list_data =
@@ -307,6 +313,11 @@ userauth_password(LIBSSH2_SESSION *session,
* 40 = packet_type(1) + username_len(4) + service_len(4) +
* service(14)"ssh-connection" + method_len(4) + method(8)"password" +
* chgpwdbool(1) + password_len(4) */
+ if(username_len > UINT32_MAX - 40) {
+ return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
+ "username_len out of bounds");
+ }
+
session->userauth_pswd_data_len = username_len + 40;
session->userauth_pswd_data0 =
@@ -447,7 +458,7 @@ password_response:
}
/* basic data_len + newpw_len(4) */
- if(username_len + password_len + 44 <= UINT_MAX) {
+ if(username_len <= UINT32_MAX - password_len - 44) {
session->userauth_pswd_data_len =
username_len + password_len + 44;
s = session->userauth_pswd_data =

3
package/libssh2/libssh2.mk
View File

@@ -13,6 +13,9 @@ LIBSSH2_CPE_ID_VENDOR = libssh2
LIBSSH2_INSTALL_STAGING = YES
LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath
# 0001-username-len-bound-checking.patch
LIBSSH2_IGNORE_CVES += CVE-2026-7598
ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
LIBSSH2_DEPENDENCIES += mbedtls
LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \