[Buildroot] [git commit] package/libssh2: fix CVE-2026-66035

commit: https://gitlab.com/buildroot.org/buildroot/-/commit/03757abfce3d5ad17e8c1b3a4f1e2e19634648fa
branch: https://gitlab.com/buildroot.org/buildroot/-/tree/master

Backport the fix for CVE-2026-66035.

The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.

Use Debian's libssh2 1.11.1 backport of the upstream fix.

Signed-off-by: Stefan Müller <[email protected]>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <[email protected]>
---
 ...ix-potential-heap-overflow-on-ETM-decrypt.patch | 42 ++++++++++++++++++++++
 package/libssh2/libssh2.mk                         |  3 ++
 2 files changed, 45 insertions(+)

diff --git a/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch b/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch
new file mode 100644
index 0000000000..18e9ec5329
--- /dev/null
+++ b/package/libssh2/0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch
@@ -0,0 +1,42 @@
+From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <[email protected]>
+Date: Fri, 3 Jul 2026 18:22:55 +0200
+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-6c79-444r-wx26
+
+Closes #2198
+Forwarded: not-needed
+
+CVE: CVE-2026-66035
+Upstream: https://sources.debian.org/patches/libssh2/1.11.1-6/CVE-2026-66035.patch/
+Upstream: https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
+Signed-off-by: Stefan Müller <[email protected]>
+---
+ src/transport.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -242,6 +242,12 @@
+                 unsigned char *decrypt_buffer;
+                 int blocksize = session->remote.crypt->blocksize;
+
++                if(p->total_num < mac_len + 4 + (size_t)blocksize) {
++                    LIBSSH2_FREE(session, p->payload);
++                    return LIBSSH2_ERROR_DECRYPT;
++                }
++                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
++
+                 rc = decrypt(session, p->payload + 4,
+                              first_block, blocksize, FIRST_BLOCK);
+                 if(rc) {
+@@ -249,7 +255,6 @@
+                 }
+
+                 /* we need buffer for decrypt */
+-                decrypt_size = p->total_num - mac_len - 4;
+                 decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
+                 if(!decrypt_buffer) {
+                     return LIBSSH2_ERROR_ALLOC;
diff --git a/package/libssh2/libssh2.mk b/package/libssh2/libssh2.mk
index 4a4491f0f1..7715b0bc0a 100644
--- a/package/libssh2/libssh2.mk
+++ b/package/libssh2/libssh2.mk
@@ -36,6 +36,9 @@ LIBSSH2_IGNORE_CVES += CVE-2026-66033
 # 0009-publickey-fix-potential-OOB-read.patch
 LIBSSH2_IGNORE_CVES += CVE-2026-66034
 
+# 0010-transport-fix-potential-heap-overflow-on-ETM-decrypt.patch
+LIBSSH2_IGNORE_CVES += CVE-2026-66035
+
 ifeq ($(BR2_PACKAGE_LIBSSH2_MBEDTLS),y)
 LIBSSH2_DEPENDENCIES += mbedtls
 LIBSSH2_CONF_OPTS += --with-libmbedcrypto-prefix=$(STAGING_DIR)/usr \

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot