mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-21 06:48:18 +00:00
Code Issues Projects Releases Wiki Activity

openssh: fix CVE-2026-73281

Browse Source 
This patch applies the upstream fix that permits session-bind requests
while the agent is locked so forwarded sessions remain classified as
remote. The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/6a57081dc35acf3ee298108d4bc3580489608d5
[2] https://www.cve.org/CVERecord?id=CVE-2026-73281

(From OE-Core rev: 10542c0b4e71d6371062799d6aaa42a6e266b88b)

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Hetvi Thakar authored and Paul Barker committed 2026-10-19 09:03:18 +01:00
1 parent eba626ca61
commit 0ce2b71ee8
2 files changed
+77
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta/recipes-connectivity/openssh/openssh/CVE-2026-73281.patch
+76
View File
@@ -0,0 +1,76 @@
From df8fe9ebecc57c486f2d1ea5b1a5c34b22858bcb Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 7 Aug 2026 05:18:05 +0000
Subject: [PATCH] upstream: Allow session-bind@openssh.com requests when the
agent is
locked, otherwise forwarding sessions established with an agent was locked
will be treated as local, rather than remote.
Reported by sn0x-sharma
OpenBSD-Commit-ID: 524f210c6f2b3a06e0a2f6d0af5188a9a75fa2c7
CVE: CVE-2026-73281
Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6a57081dc35acf3ee298108d4bc3580489608d5f]
Backport Changes:
- Omitted the upstream OpenBSD RCS revision header update because it does
not apply to the OpenSSH 9.6p1 source revision.
- OpenSSH 9.6p1 lacks the later query extension and replied/generic_fail
dispatch, so locked non-session-bind extensions retain the 9.6p1
success=false response path.
(cherry picked from commit 6a57081dc35acf3ee298108d4bc3580489608d5f)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
ssh-agent.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/ssh-agent.c b/ssh-agent.c
index 2d2c6fcc..f1c35fd2 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1778,10 +1778,19 @@ process_extension(SocketEntry *e)
error_fr(r, "parse");
goto send;
}
- if (strcmp(name, "session-bind@openssh.com") == 0)
+ /*
+ * This function can be called while the agent is locked to allow
+ * session binds to be processed for new channels.
+ * Other operations should be refused when locked.
+ */
+
+ if (strcmp(name, "session-bind@openssh.com") == 0) {
success = process_ext_session_bind(e);
- else
+ } else if (locked) {
+ debug_f("attempt to use extension \"%s\" while locked", name);
+ } else {
debug_f("unsupported extension \"%s\"", name);
+ }
free(name);
send:
send_status(e, success);
@@ -1831,16 +1840,19 @@ process_message(u_int socknum)
/* check whether agent is locked */
if (locked && type != SSH_AGENTC_UNLOCK) {
- sshbuf_reset(e->request);
switch (type) {
case SSH2_AGENTC_REQUEST_IDENTITIES:
/* send empty lists */
no_identities(e);
break;
+ case SSH_AGENTC_EXTENSION:
+ process_extension(e);
+ break;
default:
/* send a fail message for all other request types */
send_status(e, 0);
}
+ sshbuf_reset(e->request);
return 1;
}
meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+1
View File
@@ -46,6 +46,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-60000.patch \
file://CVE-2026-73283.patch \
file://CVE-2026-73282.patch \
file://CVE-2026-73281.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"