[Buildroot] [PATCH 5/5] package/libssh2: fix CVE-2026-66035

Backport the fix for CVE-2026-66035.

The ETM decrypt path does not validate the received packet length before

calculating the decrypt buffer size. A malformed packet can therefore

lead to a heap overflow.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <[email protected]>

---

Backport to: 2025.02.x

---

...tential-heap-overflow-on-ETM-decrypt.patch | 41 +++++++++++++++++++

package/libssh2/libssh2.mk | 3 ++

2 files changed, 44 insertions(+)

create mode 100644 package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

diff --git a/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch b/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

new file mode 100644

index 0000000000..ee253315d7

--- /dev/null

+++ b/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

@@ -0,0 +1,41 @@

+From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001

+From: Viktor Szakats <[email protected]>

+Date: Fri, 3 Jul 2026 18:22:55 +0200

+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt

+

+Reported-by: Vladimir Eli Tokarev

+Fixes GHSA-6c79-444r-wx26

+

+Closes #2198

+Forwarded: not-needed

+

+CVE: CVE-2026-66035

+Upstream: https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4

+Signed-off-by: Stefan Müller <[email protected]>

+---

+ src/transport.c | 7 ++++++-

+ 1 file changed, 6 insertions(+), 1 deletion(-)

+

+--- a/src/transport.c

++++ b/src/transport.c

+@@ -242,6 +242,12 @@

+ unsigned char *decrypt_buffer;

+ int blocksize = session->remote.crypt->blocksize;

+

++ if(p->total_num < mac_len + 4 + (size_t)blocksize) {

++ LIBSSH2_FREE(session, p->payload);

++ return LIBSSH2_ERROR_DECRYPT;

++ }

++ decrypt_size = (ssize_t)(p->total_num - mac_len - 4);

++

+ rc = decrypt(session, p->payload + 4,

+ first_block, blocksize, FIRST_BLOCK);

+ if(rc) {

+@@ -249,7 +255,6 @@

+ }

+

+ /* we need buffer for decrypt */

+- decrypt_size = p->total_num - mac_len - 4;

+ decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);

+ if(!decrypt_buffer) {

+ return LIBSSH2_ERROR_ALLOC;

diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk

index 4a4491f0f1..7715b0bc0a 100644

--- a/package/libssh2/libssh2.mk

+++ b/package/libssh2/libssh2.mk

@@ -36,6 +36,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66033

# 0009-publickey-fix-potential-OOB-read.patch

LIBSSH2_IGNORE_CVES += CVE-2026-66034

+# 0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch

+LIBSSH2_IGNORE_CVES += CVE-2026-66035

+

ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)

LIBSSH2_DEPENDENCIES += mbedtls

LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \

--

2.25.1

Freundliche GrüsseStefan MüllerREY TECHNOLOGY AGRütihofstrasse 6, CH-8370 SirnachStefan Müller | CTODirect +41 58 810 04 82 | Support +41 58 810 04 [email protected] | rey-technology.com

https://www.linkedin.com/company/rey-technology https://www.instagram.com/reytechnology_com/ https://teams.microsoft.com/l/chat/0/[email protected]

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot