From b19ea523d64619112e6a98d14434fe3cb29621cf Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Tue, 2 Jun 2026 22:22:45 +0200 Subject: [PATCH] package/libssh2: add upstream security patch for CVE-2026-7598 This commit fixes the following vulnerability: - CVE-2026-7598: A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue. For more information, see: - https://www.cve.org/CVERecord?id=CVE-2026-7598 - https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard (cherry picked from commit 061d6b121b116fff494901a964c813b68dc6d0de) Signed-off-by: Thomas Perale --- .../0001-username-len-bound-checking.patch | 57 +++++++++++++++++++ package/libssh2/libssh2.mk | 3 + 2 files changed, 60 insertions(+) create mode 100644 package/libssh2/0001-username-len-bound-checking.patch diff --git a/package/libssh2/0001-username-len-bound-checking.patch b/package/libssh2/0001-username-len-bound-checking.patch new file mode 100644 index 0000000000..f398260309 --- /dev/null +++ b/package/libssh2/0001-username-len-bound-checking.patch @@ -0,0 +1,57 @@ +From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001 +From: Will Cosgrove +Date: Mon, 13 Apr 2026 11:18:25 -0700 +Subject: [PATCH] userauth.c: username_len bounds checking (#1858) + +Return errors when username_len will exceed bounds, fix existing bounds +check. + +Credit: +[dapickle](https://github.com/dapickle) + +CVE: CVE-2026-7598 +Upstream: https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1 +Signed-off-by: Thomas Perale +--- + src/userauth.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/src/userauth.c b/src/userauth.c +index f8e02651..43d9ab9b 100644 +--- a/src/userauth.c ++++ b/src/userauth.c +@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username, + memset(&session->userauth_list_packet_requirev_state, 0, + sizeof(session->userauth_list_packet_requirev_state)); + ++ if(username_len > UINT32_MAX - 27) { ++ _libssh2_error(session, LIBSSH2_ERROR_PROTO, ++ "username_len out of bounds"); ++ return NULL; ++ } ++ + session->userauth_list_data_len = username_len + 27; + + s = session->userauth_list_data = +@@ -307,6 +313,11 @@ userauth_password(LIBSSH2_SESSION *session, + * 40 = packet_type(1) + username_len(4) + service_len(4) + + * service(14)"ssh-connection" + method_len(4) + method(8)"password" + + * chgpwdbool(1) + password_len(4) */ ++ if(username_len > UINT32_MAX - 40) { ++ return _libssh2_error(session, LIBSSH2_ERROR_PROTO, ++ "username_len out of bounds"); ++ } ++ + session->userauth_pswd_data_len = username_len + 40; + + session->userauth_pswd_data0 = +@@ -447,7 +458,7 @@ password_response: + } + + /* basic data_len + newpw_len(4) */ +- if(username_len + password_len + 44 <= UINT_MAX) { ++ if(username_len <= UINT32_MAX - password_len - 44) { + session->userauth_pswd_data_len = + username_len + password_len + 44; + s = session->userauth_pswd_data = + diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk index 1702d94c79..1843d25051 100644 --- a/package/libssh2/libssh2.mk +++ b/package/libssh2/libssh2.mk @@ -13,6 +13,9 @@ LIBSSH2_CPE_ID_VENDOR = libssh2 LIBSSH2_INSTALL_STAGING = YES LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath +# 0001-username-len-bound-checking.patch +LIBSSH2_IGNORE_CVES += CVE-2026-7598 + ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y) LIBSSH2_DEPENDENCIES += mbedtls LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \