From c32d12b95044db8f86f90d9f4d6c0f39e7884772 Mon Sep 17 00:00:00 2001 From: Hitendra Prajapati Date: Thu, 26 Jun 2025 10:44:47 +0530 Subject: [PATCH] libssh: fix CVE-2025-5318 Upstream-Status: Backport from https://git.libssh.org/projects/libssh.git/commit/?id=5f4ffda88770f95482fd0e66aa44106614dbf466 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster --- .../libssh/libssh/CVE-2025-5318.patch | 31 +++++++++++++++++++ .../recipes-support/libssh/libssh_0.10.6.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta-oe/recipes-support/libssh/libssh/CVE-2025-5318.patch diff --git a/meta-oe/recipes-support/libssh/libssh/CVE-2025-5318.patch b/meta-oe/recipes-support/libssh/libssh/CVE-2025-5318.patch new file mode 100644 index 0000000000..02efc7a8f3 --- /dev/null +++ b/meta-oe/recipes-support/libssh/libssh/CVE-2025-5318.patch @@ -0,0 +1,31 @@ +From 5f4ffda88770f95482fd0e66aa44106614dbf466 Mon Sep 17 00:00:00 2001 +From: Jakub Jelen +Date: Tue, 22 Apr 2025 21:18:44 +0200 +Subject: CVE-2025-5318: sftpserver: Fix possible buffer overrun + +Signed-off-by: Jakub Jelen +Reviewed-by: Andreas Schneider + +Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?id=5f4ffda88770f95482fd0e66aa44106614dbf466] +CVE: CVE-2025-5318 +Signed-off-by: Hitendra Prajapati +--- + src/sftpserver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/sftpserver.c b/src/sftpserver.c +index 9117f155..b3349e16 100644 +--- a/src/sftpserver.c ++++ b/src/sftpserver.c +@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){ + + memcpy(&val, ssh_string_data(handle), sizeof(uint32_t)); + +- if (val > SFTP_HANDLES) { ++ if (val >= SFTP_HANDLES) { + return NULL; + } + +-- +2.49.0 + diff --git a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb index 31f29c1b7d..3123500f51 100644 --- a/meta-oe/recipes-support/libssh/libssh_0.10.6.bb +++ b/meta-oe/recipes-support/libssh/libssh_0.10.6.bb @@ -10,6 +10,7 @@ SRC_URI = "git://git.libssh.org/projects/libssh.git;protocol=https;branch=stable file://0001-tests-CMakeLists.txt-do-not-search-ssh-sshd-commands.patch \ file://0001-libgcrypt.c-Fix-prototype-of-des3_encrypt-des3_decry.patch \ file://run-ptest \ + file://CVE-2025-5318.patch \ " SRCREV = "10e09e273f69e149389b3e0e5d44b8c221c2e7f6"