Skip to content

Commit 4c63394

Browse files
CBL-Mariner-Botazurelinux-securityKanishk Bansalaninda-al
authored
[AUTO-CHERRYPICK] [AutoPR- Security] Patch libssh for CVE-2025-5987, CVE-2025-5372, CVE-2025-5351, CVE-2025-5318 - branch 3.0-dev (microsoft#14299)
Co-authored-by: Azure Linux Security Servicing Account <[email protected]> Co-authored-by: Kanishk Bansal <[email protected]> Co-authored-by: Aninda <[email protected]>
1 parent 153028a commit 4c63394

File tree

5 files changed

+247
-1
lines changed

5 files changed

+247
-1
lines changed

‎SPECS/libssh/CVE-2025-5318.patch

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From b950d47ae47367a53ff3f5dc8021fc02dfcae17d Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:19:59 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5318 in libssh
6+
7+
[AI Backported] Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/commit/?id=5f4ffda88770f95482fd0e66aa44106614dbf466
8+
---
9+
src/sftpserver.c | 2 +-
10+
1 file changed, 1 insertion(+), 1 deletion(-)
11+
12+
diff --git a/src/sftpserver.c b/src/sftpserver.c
13+
index 9117f15..b3349e1 100644
14+
--- a/src/sftpserver.c
15+
+++ b/src/sftpserver.c
16+
@@ -538,7 +538,7 @@ void *sftp_handle(sftp_session sftp, ssh_string handle){
17+
18+
memcpy(&val, ssh_string_data(handle), sizeof(uint32_t));
19+
20+
- if (val > SFTP_HANDLES) {
21+
+ if (val >= SFTP_HANDLES) {
22+
return NULL;
23+
}
24+
25+
--
26+
2.45.3
27+

‎SPECS/libssh/CVE-2025-5351.patch

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
From 5f21b769c263f77db24b7a2757a7394608e3c4a4 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:07:05 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5351 in libssh
6+
7+
Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/patch/?id=6ddb730a27338983851248af59b128b995aad256
8+
---
9+
src/pki_crypto.c | 2 ++
10+
1 file changed, 2 insertions(+)
11+
12+
diff --git a/src/pki_crypto.c b/src/pki_crypto.c
13+
index 5b0d7de..aec4954 100644
14+
--- a/src/pki_crypto.c
15+
+++ b/src/pki_crypto.c
16+
@@ -2023,6 +2023,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
17+
bignum_safe_free(bn);
18+
bignum_safe_free(be);
19+
OSSL_PARAM_free(params);
20+
+ params = NULL;
21+
#endif /* OPENSSL_VERSION_NUMBER */
22+
break;
23+
}
24+
@@ -2143,6 +2144,7 @@ ssh_string pki_publickey_to_blob(const ssh_key key)
25+
*/
26+
#if 0
27+
OSSL_PARAM_free(params);
28+
+ params = NULL;
29+
#endif /* OPENSSL_VERSION_NUMBER */
30+
31+
if (key->type == SSH_KEYTYPE_SK_ECDSA &&
32+
--
33+
2.45.3
34+

‎SPECS/libssh/CVE-2025-5372.patch

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
From a9d8a3d44829cf9182b252bc951f35fb0d573972 Mon Sep 17 00:00:00 2001
2+
From: Jakub Jelen <[email protected]>
3+
Date: Wed, 14 May 2025 14:07:58 +0200
4+
Subject: CVE-2025-5372 libgcrypto: Simplify error checking and handling of
5+
return codes in ssh_kdf()
6+
7+
Signed-off-by: Jakub Jelen <[email protected]>
8+
Reviewed-by: Andreas Schneider <[email protected]>
9+
10+
Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/patch/?id=a9d8a3d44829cf9182b252bc951f35fb0d573972
11+
---
12+
src/libcrypto.c | 63 ++++++++++++++++++++++---------------------------
13+
1 file changed, 28 insertions(+), 35 deletions(-)
14+
15+
diff --git a/src/libcrypto.c b/src/libcrypto.c
16+
index 911b363..aa48c67 100644
17+
--- a/src/libcrypto.c
18+
+++ b/src/libcrypto.c
19+
@@ -163,7 +163,7 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
20+
uint8_t key_type, unsigned char *output,
21+
size_t requested_len)
22+
{
23+
- int rc = -1;
24+
+ int ret = SSH_ERROR, rv;
25+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
26+
EVP_KDF_CTX *ctx = EVP_KDF_CTX_new_id(EVP_KDF_SSHKDF);
27+
#else
28+
@@ -185,90 +185,83 @@ int ssh_kdf(struct ssh_crypto_struct *crypto,
29+
}
30+
31+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
32+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
33+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_MD,
34+
sshkdf_digest_to_md(crypto->digest_type));
35+
- if (rc != 1) {
36+
+ if (rv != 1) {
37+
goto out;
38+
}
39+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
40+
- if (rc != 1) {
41+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_KEY, key, key_len);
42+
+ if (rv != 1) {
43+
goto out;
44+
}
45+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
46+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
47+
crypto->secret_hash, crypto->digest_len);
48+
- if (rc != 1) {
49+
+ if (rv != 1) {
50+
goto out;
51+
}
52+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
53+
- if (rc != 1) {
54+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_TYPE, key_type);
55+
+ if (rv != 1) {
56+
goto out;
57+
}
58+
- rc = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
59+
+ rv = EVP_KDF_ctrl(ctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
60+
crypto->session_id, crypto->session_id_len);
61+
- if (rc != 1) {
62+
+ if (rv != 1) {
63+
goto out;
64+
}
65+
- rc = EVP_KDF_derive(ctx, output, requested_len);
66+
- if (rc != 1) {
67+
+ rv = EVP_KDF_derive(ctx, output, requested_len);
68+
+ if (rv != 1) {
69+
goto out;
70+
}
71+
#else
72+
- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
73+
+ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_DIGEST,
74+
md, strlen(md));
75+
- if (rc != 1) {
76+
- rc = -1;
77+
+ if (rv != 1) {
78+
goto out;
79+
}
80+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
81+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld, OSSL_KDF_PARAM_KEY,
82+
key, key_len);
83+
- if (rc != 1) {
84+
- rc = -1;
85+
+ if (rv != 1) {
86+
goto out;
87+
}
88+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
89+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
90+
OSSL_KDF_PARAM_SSHKDF_XCGHASH,
91+
crypto->secret_hash,
92+
crypto->digest_len);
93+
- if (rc != 1) {
94+
- rc = -1;
95+
+ if (rv != 1) {
96+
goto out;
97+
}
98+
- rc = OSSL_PARAM_BLD_push_octet_string(param_bld,
99+
+ rv = OSSL_PARAM_BLD_push_octet_string(param_bld,
100+
OSSL_KDF_PARAM_SSHKDF_SESSION_ID,
101+
crypto->session_id,
102+
crypto->session_id_len);
103+
- if (rc != 1) {
104+
- rc = -1;
105+
+ if (rv != 1) {
106+
goto out;
107+
}
108+
- rc = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
109+
+ rv = OSSL_PARAM_BLD_push_utf8_string(param_bld, OSSL_KDF_PARAM_SSHKDF_TYPE,
110+
(const char*)&key_type, 1);
111+
- if (rc != 1) {
112+
- rc = -1;
113+
+ if (rv != 1) {
114+
goto out;
115+
}
116+
117+
params = OSSL_PARAM_BLD_to_param(param_bld);
118+
if (params == NULL) {
119+
- rc = -1;
120+
goto out;
121+
}
122+
123+
- rc = EVP_KDF_derive(ctx, output, requested_len, params);
124+
- if (rc != 1) {
125+
- rc = -1;
126+
+ rv = EVP_KDF_derive(ctx, output, requested_len, params);
127+
+ if (rv != 1) {
128+
goto out;
129+
}
130+
#endif /* OPENSSL_VERSION_NUMBER */
131+
-
132+
+ ret = SSH_OK;
133+
out:
134+
#if OPENSSL_VERSION_NUMBER >= 0x30000000L
135+
OSSL_PARAM_BLD_free(param_bld);
136+
OSSL_PARAM_free(params);
137+
#endif
138+
EVP_KDF_CTX_free(ctx);
139+
- if (rc < 0) {
140+
- return rc;
141+
+ if (ret < 0) {
142+
+ return ret;
143+
}
144+
return 0;
145+
}
146+
--
147+
2.34.1
148+

‎SPECS/libssh/CVE-2025-5987.patch

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From 3f1f9958b798bffbf2968306712aea63d93eebf9 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account
3+
<[email protected]>
4+
Date: Thu, 10 Jul 2025 14:19:53 +0000
5+
Subject: [PATCH] Fix CVE CVE-2025-5987 in libssh
6+
7+
[AI Backported] Upstream Patch Reference: https://git.libssh.org/projects/libssh.git/commit/?id=90b4845e0c98574bbf7bea9e97796695f064bf57
8+
---
9+
src/libcrypto.c | 4 ++--
10+
1 file changed, 2 insertions(+), 2 deletions(-)
11+
12+
diff --git a/src/libcrypto.c b/src/libcrypto.c
13+
index 4f945d9..911b363 100644
14+
--- a/src/libcrypto.c
15+
+++ b/src/libcrypto.c
16+
@@ -777,9 +777,9 @@ chacha20_poly1305_set_key(struct ssh_cipher_struct *cipher,
17+
SSH_LOG(SSH_LOG_WARNING, "EVP_CIPHER_CTX_new failed");
18+
goto out;
19+
}
20+
- ret = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
21+
+ rv = EVP_EncryptInit_ex(ctx->header_evp, EVP_chacha20(), NULL,
22+
u8key + CHACHA20_KEYLEN, NULL);
23+
- if (ret != 1) {
24+
+ if (rv != 1) {
25+
SSH_LOG(SSH_LOG_WARNING, "EVP_CipherInit failed");
26+
goto out;
27+
}
28+
--
29+
2.45.3
30+

‎SPECS/libssh/libssh.spec

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Vendor: Microsoft Corporation
22
Distribution: Azure Linux
33
Name: libssh
44
Version: 0.10.6
5-
Release: 1%{?dist}
5+
Release: 2%{?dist}
66
Summary: A library implementing the SSH protocol
77
License: LGPLv2+
88
URL: http://www.libssh.org
@@ -12,6 +12,10 @@ Source1: https://www.libssh.org/files/0.10/%{name}-%{version}.tar.xz.asc
1212
Source2: https://cryptomilk.org/gpgkey-8DFF53E18F2ABC8D8F3C92237EE0FC4DCC014E3D.gpg#/%{name}.keyring
1313
Source3: libssh_client.config
1414
Source4: libssh_server.config
15+
Patch0: CVE-2025-5987.patch
16+
Patch1: CVE-2025-5372.patch
17+
Patch2: CVE-2025-5351.patch
18+
Patch3: CVE-2025-5318.patch
1519

1620
BuildRequires: cmake
1721
BuildRequires: gcc-c++
@@ -144,6 +148,9 @@ popd
144148
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/libssh/libssh_server.config
145149

146150
%changelog
151+
* Thu Jul 10 2025 Azure Linux Security Servicing Account <[email protected]> - 0.10.6-2
152+
- Patch for CVE-2025-5987, CVE-2025-5372, CVE-2025-5351, CVE-2025-5318
153+
147154
* Tue Feb 25 2025 CBL-Mariner Servicing Account <[email protected]> - 0.10.6-1
148155
- Auto-upgrade to 0.10.6 - for CVE-2023-6004, CVE-2023-6918 & CVE-2023-48795 [Medium]
149156

0 commit comments

Comments
 (0)