* [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (6 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59999
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59999.patch | 36 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
new file mode 100644
index 0000000000..89b7aa9c7f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
@@ -0,0 +1,36 @@
+From 1c719fa7d0fb0aa335f0e8d5db5d5e5d01c894e5 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 31 May 2026 04:47:29 +0000
+Subject: [PATCH] upstream: DisableForwarding=yes didn't override
+ PermitTunnel=yes
+
+Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
+Jevtic; ok markus@
+
+CVE: CVE-2026-59999
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753]
+
+Backport Changes:
+- Retained the Scarthgap serverloop.c OpenBSD revision identifier because
+ the 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
+(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ serverloop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/serverloop.c b/serverloop.c
+index f3683c2e4..c1fe99d12 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -531,7 +531,7 @@ server_request_tun(struct ssh *ssh)
+ ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ return NULL;
+ }
+- if ((options.permit_tun & mode) == 0) {
++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
+ ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ "forwarding");
+ return NULL;
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 4193bc8a5b..efb89d45d7 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -37,6 +37,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35385.patch \
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
+ file://CVE-2026-59999.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (5 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59997
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59997.patch | 58 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 59 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
new file mode 100644
index 0000000000..aa171def01
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
@@ -0,0 +1,58 @@
+From 3011cbb6bb73f3f3dc90fa1d48736803fa407509 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 5 Jun 2026 08:53:07 +0000
+Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp
+ server,
+
+previously they were silently dropped; reported by Steve Caffrey ok deraadt@
+
+CVE: CVE-2026-59997
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014]
+
+Backport Changes:
+- Retained the Scarthgap session.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624
+(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ session.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/session.c b/session.c
+index eb932b8bf..1a01ecf74 100644
+--- a/session.c
++++ b/session.c
+@@ -1650,21 +1650,22 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+ exit(1);
+ } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
+ extern int optind, optreset;
+- int i;
+- char *p, *args;
++ int sftp_argc;
++ char **sftp_argv;
+
+ setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
+- args = xstrdup(command ? command : "sftp-server");
+- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
+- if (i < ARGV_MAX - 1)
+- argv[i++] = p;
+- argv[i] = NULL;
++ if (argv_split(command == NULL ? "sftp-server" : command,
++ &sftp_argc, &sftp_argv, 1) != 0) {
++ error("internal error: can't split internal-sftp "
++ "arguments");
++ exit(1);
++ }
+ optind = optreset = 1;
+- __progname = argv[0];
++ __progname = sftp_argv[0];
+ #ifdef WITH_SELINUX
+ ssh_selinux_change_context("sftpd_t");
+ #endif
+- exit(sftp_server_main(i, argv, s->pw));
++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw));
+ }
+
+ fflush(NULL);
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index efb89d45d7..3c706b00ae 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -38,6 +38,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35414-CVE-2026-35387.patch \
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
+ file://CVE-2026-59997.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 1/8] openssh: Fix CVE-2026-59999 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 2/8] openssh: Fix CVE-2026-59997 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (4 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59998. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59998
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59998.patch | 34 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
new file mode 100644
index 0000000000..a9a13aa70e
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59998.patch
@@ -0,0 +1,34 @@
+From f1fd8585548735bcba25faa13073aafb5f8686ca Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 24 Jun 2026 06:55:12 +0000
+Subject: [PATCH] upstream: mention a caveat regarding
+ GSSAPIStrictAcceptorCheck in
+
+some environments
+
+CVE: CVE-2026-59998
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8058c5bdb507591b79ec926221fbe6fcc296d432]
+
+Backport Changes:
+- Retained the Scarthgap sshd_config.5 OpenBSD revision identifier and
+ Mdocdate because the 10.4 values do not describe the older manual page.
+
+OpenBSD-Commit-ID: aa7158d8f22cb34063c1c2d3cbcf30a9489847c2
+(cherry picked from commit 8058c5bdb507591b79ec926221fbe6fcc296d432)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sshd_config.5 | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sshd_config.5 b/sshd_config.5
+index 7e1a56cd0..e1c8dcaa2 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -745,6 +745,7 @@ machine's default store.
+ This facility is provided to assist with operation on multi homed machines.
+ The default is
+ .Cm yes .
++This option may not be effective in Windows Active Directory environments.
+ .It Cm HostbasedAcceptedAlgorithms
+ Specifies the signature algorithms that will be accepted for hostbased
+ authentication as a list of comma-separated patterns.
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 3c706b00ae..256d90e7bd 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -39,6 +39,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-35388.patch \
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
+ file://CVE-2026-59998.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 preceding siblings ...)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 3/8] openssh: Fix CVE-2026-59998 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59996. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59996
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59996.patch | 37 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
new file mode 100644
index 0000000000..b13390b25b
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
@@ -0,0 +1,37 @@
+From 762b3d438547893d62ce3e147dce6cef14697b09 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 28 Jun 2026 23:47:16 +0000
+Subject: [PATCH] upstream: resist that return ".." via remote glob during
+
+remote/remote copies, similar to fixes for bz3871 for remote/local copies.
+From Swival scanner
+
+CVE: CVE-2026-59996
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78]
+
+Backport Changes:
+- Retained the Scarthgap scp.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5
+(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ scp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scp.c b/scp.c
+index 2c21fa19a..00d87517d 100644
+--- a/scp.c
++++ b/scp.c
+@@ -2043,6 +2043,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index 256d90e7bd..c2e172c8d6 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -40,6 +40,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
+ file://CVE-2026-59996.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (3 preceding siblings ...)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 4/8] openssh: Fix CVE-2026-59996 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (2 subsequent siblings)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59995. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59995
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-59995.patch | 42 +++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
new file mode 100644
index 0000000000..9b6fee198f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
@@ -0,0 +1,42 @@
+From b340eaa274a7e7dffea03bcb62169249bbddab37 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 29 Jun 2026 01:47:21 +0000
+Subject: [PATCH] upstream: avoid download to server-controlled path when
+ performing
+
+download on the commandline. From Swival scanner
+
+CVE: CVE-2026-59995
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b]
+
+Backport Changes:
+- Retained the Scarthgap sftp.c OpenBSD revision identifier because the
+ 10.4 identifier does not describe the older source baseline.
+
+OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
+(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sftp.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sftp.c b/sftp.c
+index c609b4153..487e53976 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2268,13 +2268,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ return (-1);
+ }
+ } else {
+- /* XXX this is wrong wrt quoting */
+- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+- global_aflag ? " -a" : "", dir,
+- file2 == NULL ? "" : " ",
+- file2 == NULL ? "" : file2);
+- err = parse_dispatch_command(conn, cmd,
+- &remote_path, startdir, 1, 0);
++ err = process_get(conn, dir, file2, remote_path, 0, 0,
++ global_aflag, 0);
+ free(dir);
+ free(startdir);
+ free(remote_path);
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index c2e172c8d6..b4885ab151 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -41,6 +41,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59997.patch \
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
+ file://CVE-2026-59995.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (4 preceding siblings ...)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 5/8] openssh: Fix CVE-2026-59995 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60001. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60001
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 131 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
new file mode 100644
index 0000000000..ff1d14c7c9
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
@@ -0,0 +1,130 @@
+From ef41798b35a53757f8aa08ad14ee1463b0fe9b15 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:44:48 +0000
+Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive
+
+authentication where the minimum per-attempt delay was not being enforced.
+
+Reported by Orange Cyberdefense Vulnerability Team
+
+CVE: CVE-2026-60001
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454]
+
+Backport Changes:
+- Kept Scarthgap's PRIVSEP(ssh_gssapi_userok()) interface and GSSAPI
+ display-name recording while adding the upstream failure-delay calls;
+ mm_ssh_gssapi_userok() belongs to the later split-sshd architecture.
+- Retained the Scarthgap OpenBSD revision identifiers in auth.h,
+ auth2-chall.c, auth2-gss.c, and auth2.c.
+
+OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e
+(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth.h | 1 +
+ auth2-chall.c | 4 ++++
+ auth2-gss.c | 7 +++++++
+ auth2.c | 10 ++++++++--
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/auth.h b/auth.h
+index 6d2d39762..9ad4898c5 100644
+--- a/auth.h
++++ b/auth.h
+@@ -173,6 +173,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *);
+ void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn));
+ void userauth_finish(struct ssh *, int, const char *, const char *);
+ int auth_root_allowed(struct ssh *, const char *);
++void auth_failure_delay(Authctxt *, double);
+
+ char *auth2_read_banner(void);
+ int auth2_methods_valid(const char *, int);
+diff --git a/auth2-chall.c b/auth2-chall.c
+index 021df8291..20e70d222 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -296,6 +296,7 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
+ u_int i, nresp;
+ const char *devicename = NULL;
+ char **response = NULL;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal_f("no authctxt");
+@@ -354,6 +355,9 @@ input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
+ auth2_challenge_start(ssh);
+ }
+ }
++
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+ userauth_finish(ssh, authenticated, "keyboard-interactive",
+ devicename);
+ return 0;
+diff --git a/auth2-gss.c b/auth2-gss.c
+index f72a38998..195578bcf 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+ Authctxt *authctxt = ssh->authctxt;
+ int r, authenticated;
+ const char *displayname;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, u_int32_t plen, struct ssh *ssh)
+ fatal_fr(r, "parse packet");
+
+ authenticated = PRIVSEP(ssh_gssapi_userok(authctxt->user));
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+
+ if ((!use_privsep || mm_is_monitor()) &&
+ (displayname = ssh_gssapi_displayname()) != NULL)
+@@ -293,6 +296,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+ const char *displayname;
+ u_char *p;
+ size_t len;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+@@ -320,6 +324,9 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
+ sshbuf_free(b);
+ free(mic.value);
+
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
++
+ if ((!use_privsep || mm_is_monitor()) &&
+ (displayname = ssh_gssapi_displayname()) != NULL)
+ auth2_record_info(authctxt, "%s", displayname);
+diff --git a/auth2.c b/auth2.c
+index 271789a77..18077d625 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds)
+ nanosleep(&ts, NULL);
+ }
+
++void
++auth_failure_delay(Authctxt *authctxt, double tstart)
++{
++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user));
++}
++
+ static int
+ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ {
+@@ -348,8 +354,8 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
+ authenticated = m->userauth(ssh, method);
+ }
+ if (!authctxt->authenticated && strcmp(method, "none") != 0)
+- ensure_minimum_time_since(tstart,
+- user_specific_delay(authctxt->user));
++ auth_failure_delay(authctxt, tstart);
++
+ userauth_finish(ssh, authenticated, method, NULL);
+ r = 0;
+ out:
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index b4885ab151..b15b909f60 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -42,6 +42,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59998.patch \
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
+ file://CVE-2026-60001.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (5 preceding siblings ...)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 6/8] openssh: Fix CVE-2026-60001 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60002. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60002
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60002.patch | 226 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 227 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
new file mode 100644
index 0000000000..9e94e77261
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
@@ -0,0 +1,226 @@
+From 767104acedd68c317b9d8fb603561e1a8be9e76a Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:49:58 +0000
+Subject: [PATCH] upstream: fix ownership and lifetime of several bits of
+ client
+
+state that need to persist for the life of the connection, especially the
+cached hostkey that was being incorrectly freed early on some paths, possibly
+allowing its use after free.
+
+Reported by Zhenpeng (Leo) Lin from depthfirst.com
+
+CVE: CVE-2026-60002
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23]
+
+Backport Changes:
+- Retained Scarthgap's valid_hostname() and valid_ruser() helpers when
+ relocating ssh_conn_info_free() from ssh.c to sshconnect.c.
+- Retained Scarthgap's ext-info-c proposal handling while applying the
+ upstream connection-state ownership and lifetime changes.
+- Retained the Scarthgap OpenBSD revision identifiers in ssh.c,
+ sshconnect.c, sshconnect.h, and sshconnect2.c.
+
+OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f
+(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ ssh.c | 24 ++----------------------
+ sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ sshconnect.h | 7 +++++--
+ sshconnect2.c | 20 +++++++++++---------
+ 4 files changed, 63 insertions(+), 35 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 9c49f98a8..aecdb79ea 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -606,26 +606,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port)
+ }
+ }
+
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+- if (cinfo == NULL)
+- return;
+- free(cinfo->conn_hash_hex);
+- free(cinfo->shorthost);
+- free(cinfo->uidstr);
+- free(cinfo->keyalias);
+- free(cinfo->thishost);
+- free(cinfo->host_arg);
+- free(cinfo->portstr);
+- free(cinfo->remhost);
+- free(cinfo->remuser);
+- free(cinfo->homedir);
+- free(cinfo->locuser);
+- free(cinfo->jmphost);
+- free(cinfo);
+-}
+-
+ static int
+ valid_hostname(const char *s)
+ {
+@@ -1771,8 +1751,8 @@ main(int ac, char **av)
+ ssh_signal(SIGCHLD, main_sigchld_handler);
+
+ /* Log into the remote system. Never returns if the login fails. */
+- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+- options.port, pw, timeout_ms, cinfo);
++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++ pw, timeout_ms, cinfo);
+
+ /* We no longer need the private host keys. Clear them now. */
+ if (sensitive_data.nkeys != 0) {
+diff --git a/sshconnect.c b/sshconnect.c
+index bd077c75c..7823b6782 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -83,6 +83,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++ if (cinfo == NULL)
++ return;
++ free(cinfo->conn_hash_hex);
++ free(cinfo->shorthost);
++ free(cinfo->uidstr);
++ free(cinfo->keyalias);
++ free(cinfo->thishost);
++ free(cinfo->host_arg);
++ free(cinfo->portstr);
++ free(cinfo->remhost);
++ free(cinfo->remuser);
++ free(cinfo->homedir);
++ free(cinfo->locuser);
++ free(cinfo->jmphost);
++ freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++ struct ssh_conn_info *ret;
++
++ if (cinfo == NULL)
++ return NULL;
++ ret = xcalloc(1, sizeof(*ret));
++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++ ret->shorthost = xstrdup(cinfo->shorthost);
++ ret->uidstr = xstrdup(cinfo->uidstr);
++ ret->keyalias = xstrdup(cinfo->keyalias);
++ ret->thishost = xstrdup(cinfo->thishost);
++ ret->host_arg = xstrdup(cinfo->host_arg);
++ ret->portstr = xstrdup(cinfo->portstr);
++ ret->remhost = xstrdup(cinfo->remhost);
++ ret->remuser = xstrdup(cinfo->remuser);
++ ret->homedir = xstrdup(cinfo->homedir);
++ ret->locuser = xstrdup(cinfo->locuser);
++ ret->jmphost = xstrdup(cinfo->jmphost);
++ return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1559,8 +1602,8 @@ out:
+ */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+- const struct ssh_conn_info *cinfo)
++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++ int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ char *host;
+ char *server_user, *local_user;
+diff --git a/sshconnect.h b/sshconnect.h
+index 79d35cc19..da2a73f5a 100644
+--- a/sshconnect.h
++++ b/sshconnect.h
+@@ -71,7 +71,7 @@ int ssh_connect(struct ssh *, const char *, const char *,
+ void ssh_kill_proxy_command(void);
+
+ void ssh_login(struct ssh *, Sensitive *, const char *,
+- struct sockaddr *, u_short, struct passwd *, int,
++ struct sockaddr_storage *, u_short, struct passwd *, int,
+ const struct ssh_conn_info *);
+
+ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -80,7 +80,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+ void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+ char **, char **);
+
+-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+ const struct ssh_conn_info *);
+
+ void ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -94,3 +94,6 @@ void maybe_add_key_to_agent(const char *, struct sshkey *,
+ void load_hostkeys_command(struct hostkeys *, const char *,
+ const char *, const struct ssh_conn_info *,
+ const struct sshkey *, const char *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
+diff --git a/sshconnect2.c b/sshconnect2.c
+index a296c9b8c..9efb3da8a 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -89,7 +89,7 @@ extern Options options;
+ */
+
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+
+@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
+- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+@@ -222,16 +222,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
+ }
+
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+- const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++ u_short port, const struct ssh_conn_info *cinfo)
+ {
+ char *myproposal[PROPOSAL_MAX];
+ char *s, *all_key, *hkalgs = NULL;
+ int r, use_known_hosts_order = 0;
+
+- xxx_host = host;
+- xxx_hostaddr = hostaddr;
+- xxx_conn_info = cinfo;
++ xxx_host = xstrdup(host);
++ xxx_hostaddr = *hostaddr;
++ xxx_conn_info = ssh_conn_info_dup(cinfo);
+
+ if (options.rekey_limit || options.rekey_interval)
+ ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -257,8 +257,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+ if ((s = kex_names_cat(options.kex_algorithms, "ext-info-c")) == NULL)
+ fatal_f("kex_names_cat");
+
+- if (use_known_hosts_order)
+- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++ if (use_known_hosts_order) {
++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++ port, cinfo);
++ }
+
+ kex_proposal_populate_entries(ssh, myproposal, s, options.ciphers,
+ options.macs, compression_alg_list(options.compression),
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index b15b909f60..a6bf37d8a6 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -43,6 +43,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
+ file://CVE-2026-60002.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread* [OE-core][scarthgap][PATCH 8/8] openssh: Fix CVE-2026-60000
2026-07-20 18:57 [OE-core][scarthgap][PATCH 0/8] openssh: Security fixes Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
` (6 preceding siblings ...)
2026-07-20 18:57 ` [OE-core][scarthgap][PATCH 7/8] openssh: Fix CVE-2026-60002 Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
@ 2026-07-20 18:57 ` Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)
7 siblings, 0 replies; 9+ messages in thread
From: Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco) @ 2026-07-20 18:57 UTC (permalink / raw)
To: openembedded-core; +Cc: xe-linux-external, Devansh Patel
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60000. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60000
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
.../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++
.../openssh/openssh_9.6p1.bb | 1 +
2 files changed, 141 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
new file mode 100644
index 0000000000..9c25786ced
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
@@ -0,0 +1,140 @@
+From 055316632809a2e2e58eac2020699b52187d1b11 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:53:30 +0000
+Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication)
+ compliance
+
+problems
+
+1) Remove an early failure return for GSSAPI authentication attempts
+made for invalid accounts that yielded different behaviour for
+valid vs invalid accounts.
+
+2) Fix a situation where some GSSAPI requestes were not correctly
+subjected to MaxAuthTries.
+
+3) Fix a moderate pre-authentication resource DoS related to #2.
+
+Add missing logging for error cases.
+
+Report and fixes from Manfred Kaiser, milCERT AT
+
+CVE: CVE-2026-60000
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192]
+
+Backport Changes:
+- Kept Scarthgap's PRIVSEP(ssh_gssapi_server_ctx()) interface and its
+ authentication-context guard while applying the upstream RFC 4462 state,
+ failure, logging, and MaxAuthTries changes.
+- Retained the Scarthgap auth2-gss.c OpenBSD revision identifier.
+
+OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3
+(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth2-gss.c | 53 ++++++++++++++++++++++++-----------------------------
+ 1 file changed, 24 insertions(+), 29 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 195578bcf..6846eae5b 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -110,12 +110,6 @@ userauth_gssapi(struct ssh *ssh, const char *method)
+ return (0);
+ }
+
+- if (!authctxt->valid || authctxt->user == NULL) {
+- debug2_f("disabled because of invalid user");
+- free(doid);
+- return (0);
+- }
+-
+ if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
+ if (ctxt != NULL)
+ ssh_gssapi_delete_ctx(&ctxt);
+@@ -177,8 +171,14 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
+ (r = sshpkt_send(ssh)) != 0)
+ fatal_fr(r, "send ERRTOK packet");
+ }
++ logit("Failed gssapi-with-mic for %s%.100s "
++ "from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ } else {
+ if (send_tok.length != 0) {
+@@ -190,14 +190,18 @@ input_gssapi_token(int type, u_int32_t plen, struct ssh *ssh)
+ fatal_fr(r, "send TOKEN packet");
+ }
+ if (maj_status == GSS_S_COMPLETE) {
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+- if (flags & GSS_C_INTEG_FLAG)
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */
++ if (flags & GSS_C_INTEG_FLAG) {
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_MIC,
+ &input_gssapi_mic);
+- else
++ } else {
+ ssh_dispatch_set(ssh,
+ SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
+ &input_gssapi_exchange_complete);
++ }
+ }
+ }
+
+@@ -209,10 +213,6 @@ static int
+ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+- Gssctxt *gssctxt;
+- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+- gss_buffer_desc recv_tok;
+- OM_uint32 maj_status;
+ int r;
+ u_char *p;
+ size_t len;
+@@ -220,26 +220,21 @@ input_gssapi_errtok(int type, u_int32_t plen, struct ssh *ssh)
+ if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
+ fatal("No authentication or GSSAPI context");
+
+- gssctxt = authctxt->methoddata;
+- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
++ /* Minimal error handling - just cancel auth and return FAILURE */
++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ fatal_fr(r, "parse packet");
+- recv_tok.value = p;
+- recv_tok.length = len;
+-
+- /* Push the error token into GSSAPI to see what it says */
+- maj_status = PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
+- &send_tok, NULL));
+-
+- free(recv_tok.value);
+
+- /* We can't return anything to the client, even if we wanted to */
++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
++ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+-
+- /* The client will have already moved on to the next auth */
+-
+- gss_release_buffer(&maj_status, &send_tok);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ return 0;
+ }
+
diff --git a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
index a6bf37d8a6..95c546489f 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.6p1.bb
@@ -44,6 +44,7 @@ SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
file://CVE-2026-60002.patch \
+ file://CVE-2026-60000.patch \
"
SRC_URI[sha256sum] = "910211c07255a8c5ad654391b40ee59800710dd8119dd5362de09385aa7a777c"
--
2.44.4
^ permalink raw reply related [flat|nested] 9+ messages in thread