Re: [Buildroot] [PATCH v2 1/2] package/libssh2: add upstream patch for CVE-2026-55199

[Fiona Klute via buildroot <buildroot@buildroot.org>]

Am 30.06.26 um 21:41 schrieb Thomas Perale:
> Fixes the following vulnerability:
> 
> - CVE-2026-55199:
>      libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
>      authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
>      handler in src/packet.c that allows a malicious SSH server to cause a
>      client CPU exhaustion loop by sending a crafted extension count value.
>      A malicious server can set nr_extensions to 0xFFFFFFFF during key
>      exchange, causing the client to spin in a tight CPU loop for over 60
>      seconds because return values from _libssh2_get_string() are unchecked
>      and the session timeout does not apply to CPU-bound loops.
> 
> For more information, see:
>    - https://www.cve.org/CVERecord?id=CVE-2026-55199
>    - https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
> 
> Signed-off-by: Thomas Perale <thomas.perale@mind.be>

And series applied to master, thank you!

> ---
>   ...et-string-return-in-EXT-INFO-handler.patch | 43 +++++++++++++++++++
>   package/libssh2/libssh2.mk                    |  3 ++
>   2 files changed, 46 insertions(+)
>   create mode 100644 package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> 
> diff --git a/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> new file mode 100644
> index 0000000000..c7319a6b51
> --- /dev/null
> +++ b/package/libssh2/0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> @@ -0,0 +1,43 @@
> +From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001
> +From: TristanInSec <tristan.mtn@gmail.com>
> +Date: Wed, 15 Apr 2026 14:51:08 -0400
> +Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
> + handler
> +
> +The `SSH_MSG_EXT_INFO` handler discards the return values from
> +`_libssh2_get_string()` when parsing extension name/value pairs. When
> +the buffer is exhausted before all claimed extensions are parsed,
> +the loop continues with no-op iterations until `nr_extensions` reaches
> +zero.
> +
> +The `nr_extensions >= 1024` cap limits the worst case, but the loop
> +should still break on parse failure for correctness and consistency
> +with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
> +`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
> +
> +Closes #1864
> +
> +CVE: CVE-2026-55199
> +Upstream: https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
> +Signed-off-by: Thomas Perale <thomas.perale@mind.be>
> +---
> + src/packet.c | 6 ++++--
> + 1 file changed, 4 insertions(+), 2 deletions(-)
> +
> +diff --git a/src/packet.c b/src/packet.c
> +index ae86365d2a..8a7a0d2690 100644
> +--- a/src/packet.c
> ++++ b/src/packet.c
> +@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
> +
> +                     nr_extensions -= 1;
> +
> +-                    _libssh2_get_string(&buf, &name, &name_len);
> +-                    _libssh2_get_string(&buf, &value, &value_len);
> ++                    if(_libssh2_get_string(&buf, &name, &name_len))
> ++                        break;
> ++                    if(_libssh2_get_string(&buf, &value, &value_len))
> ++                        break;
> +
> +                     if(name && value) {
> +                         _libssh2_debug((session,
> diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
> index 1843d25051..c85129a7cd 100644
> --- a/package/libssh2/libssh2.mk
> +++ b/package/libssh2/libssh2.mk
> @@ -16,6 +16,9 @@ LIBSSH2_CONF_OPTS = --disable-examples-build --disable-rpath
>   # 0001-username-len-bound-checking.patch
>   LIBSSH2_IGNORE_CVES += CVE-2026-7598
>   
> +# 0002-packet-check-libssh2-get-string-return-in-EXT-INFO-handler.patch
> +LIBSSH2_IGNORE_CVES += CVE-2026-55199
> +
>   ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
>   LIBSSH2_DEPENDENCIES += mbedtls
>   LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot