mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

libssh 0.10.6: Fix CVE-2025-8114

Browse Source 
Upstream Repository: https://git.libssh.org/projects/libssh.git/

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-8114
Type: Security Fix
CVE: CVE-2025-8114
Score: 4.7
Patch: https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
This commit is contained in:
Anil Dongare
2025-09-19 03:30:35 -07:00
committed by Anuj Mittal
parent 385b1baa2b
commit 49aa81f2d5
2 changed files with 50 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/libssh/libssh/CVE-2025-8114.patch
+49
View File
@@ -0,0 +1,49 @@
From 5f4950367c027aa91fcea240df354a856a4a0025 Mon Sep 17 00:00:00 2001
From: Andreas Schneider <asn@cryptomilk.org>
Date: Wed, 6 Aug 2025 15:17:59 +0200
Subject: [PATCH] CVE-2025-8114: Fix NULL pointer dereference after allocation
failure
CVE: CVE-2025-8114
Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb]
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
(cherry picked from commit 53ac23ded4cb2c5463f6c4cd1525331bd578812d)
Signed-off-by: Anil Dongare <adongare@cisco.com>
---
src/kex.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/kex.c b/src/kex.c
index fbc70cf4..b4bab277 100644
--- a/src/kex.c
+++ b/src/kex.c
@@ -1391,6 +1391,8 @@ int ssh_make_sessionid(ssh_session session)
ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf));
#endif
+ /* Set rc for the following switch statement in case we goto error. */
+ rc = SSH_ERROR;
switch (session->next_crypto->kex_type) {
case SSH_KEX_DH_GROUP1_SHA1:
case SSH_KEX_DH_GROUP14_SHA1:
@@ -1450,6 +1452,7 @@ int ssh_make_sessionid(ssh_session session)
session->next_crypto->secret_hash);
break;
}
+
/* During the first kex, secret hash and session ID are equal. However, after
* a key re-exchange, a new secret hash is calculated. This hash will not replace
* but complement existing session id.
@@ -1458,6 +1461,7 @@ int ssh_make_sessionid(ssh_session session)
session->next_crypto->session_id = malloc(session->next_crypto->digest_len);
if (session->next_crypto->session_id == NULL) {
ssh_set_error_oom(session);
+ rc = SSH_ERROR;
goto error;
}
memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash,
--
2.43.5
meta-oe/recipes-support/libssh/libssh_0.10.6.bb
+1
View File
@@ -17,6 +17,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable
file://CVE-2025-4878-0001.patch \
file://CVE-2025-4878-0002.patch \
file://CVE-2025-5987.patch \
file://CVE-2025-8114.patch \
"
SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"