Skip to content

Commit d05cd38

Browse files
CBL-Mariner-BotCBL-Mariner-Bot
authored
[AUTO-CHERRYPICK] [AUTO-PR] azure-core/azurelinux:fasttrack/3.0 - branch 3.0-dev (#12482)
1 parent 3d76e27 commit d05cd38

3 files changed

Lines changed: 161 additions & 1 deletion

File tree

‎SPECS/openssh/CVE-2025-26465.patch‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
diff --git a/krl.c b/krl.c
2+
index 51a2871..4ecb2c7 100644
3+
--- a/krl.c
4+
+++ b/krl.c
5+
@@ -672,6 +672,7 @@ revoked_certs_generate(struct revoked_certs *rc, struct sshbuf *buf)
6+
break;
7+
case KRL_SECTION_CERT_SERIAL_BITMAP:
8+
if (rs->lo - bitmap_start > INT_MAX) {
9+
+ r = SSH_ERR_INVALID_FORMAT;
10+
error_f("insane bitmap gap");
11+
goto out;
12+
}
13+
@@ -1057,6 +1058,7 @@ ssh_krl_from_blob(struct sshbuf *buf, struct ssh_krl **krlp)
14+
}
15+
16+
if ((krl = ssh_krl_init()) == NULL) {
17+
+ r = SSH_ERR_ALLOC_FAIL;
18+
error_f("alloc failed");
19+
goto out;
20+
}
21+
diff --git a/packet.c b/packet.c
22+
index 72803fd..fa0f7ca 100644
23+
--- a/packet.c
24+
+++ b/packet.c
25+
@@ -1839,6 +1839,14 @@ ssh_packet_read_poll_seqnr(struct ssh *ssh, u_char *typep, u_int32_t *seqnr_p)
26+
if ((r = sshpkt_get_string_direct(ssh, &d, &len)) != 0)
27+
return r;
28+
DBG(debug("Received SSH2_MSG_PING len %zu", len));
29+
+ if (!ssh->state->after_authentication) {
30+
+ DBG(debug("Won't reply to PING in preauth"));
31+
+ break;
32+
+ }
33+
+ if (ssh_packet_is_rekeying(ssh)) {
34+
+ DBG(debug("Won't reply to PING during KEX"));
35+
+ break;
36+
+ }
37+
if ((r = sshpkt_start(ssh, SSH2_MSG_PONG)) != 0 ||
38+
(r = sshpkt_put_string(ssh, d, len)) != 0 ||
39+
(r = sshpkt_send(ssh)) != 0)
40+
diff --git a/ssh-agent.c b/ssh-agent.c
41+
index 73276f6..607c4a0 100644
42+
--- a/ssh-agent.c
43+
+++ b/ssh-agent.c
44+
@@ -1207,6 +1207,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
45+
"restrict-destination-v00@openssh.com") == 0) {
46+
if (*dcsp != NULL) {
47+
error_f("%s already set", ext_name);
48+
+ r = SSH_ERR_INVALID_FORMAT;
49+
goto out;
50+
}
51+
if ((r = sshbuf_froms(m, &b)) != 0) {
52+
@@ -1216,6 +1217,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
53+
while (sshbuf_len(b) != 0) {
54+
if (*ndcsp >= AGENT_MAX_DEST_CONSTRAINTS) {
55+
error_f("too many %s constraints", ext_name);
56+
+ r = SSH_ERR_INVALID_FORMAT;
57+
goto out;
58+
}
59+
*dcsp = xrecallocarray(*dcsp, *ndcsp, *ndcsp + 1,
60+
@@ -1233,6 +1235,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
61+
}
62+
if (*certs != NULL) {
63+
error_f("%s already set", ext_name);
64+
+ r = SSH_ERR_INVALID_FORMAT;
65+
goto out;
66+
}
67+
if ((r = sshbuf_get_u8(m, &v)) != 0 ||
68+
@@ -1244,6 +1247,7 @@ parse_key_constraint_extension(struct sshbuf *m, char **sk_providerp,
69+
while (sshbuf_len(b) != 0) {
70+
if (*ncerts >= AGENT_MAX_EXT_CERTS) {
71+
error_f("too many %s constraints", ext_name);
72+
+ r = SSH_ERR_INVALID_FORMAT;
73+
goto out;
74+
}
75+
*certs = xrecallocarray(*certs, *ncerts, *ncerts + 1,
76+
@@ -1744,6 +1748,7 @@ process_ext_session_bind(SocketEntry *e)
77+
/* record new key/sid */
78+
if (e->nsession_ids >= AGENT_MAX_SESSION_IDS) {
79+
error_f("too many session IDs recorded");
80+
+ r = -1;
81+
goto out;
82+
}
83+
e->session_ids = xrecallocarray(e->session_ids, e->nsession_ids,
84+
diff --git a/ssh-sk-client.c b/ssh-sk-client.c
85+
index c00c633..27d27a2 100644
86+
--- a/ssh-sk-client.c
87+
+++ b/ssh-sk-client.c
88+
@@ -429,6 +429,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
89+
}
90+
if ((srk = calloc(1, sizeof(*srk))) == NULL) {
91+
error_f("calloc failed");
92+
+ r = SSH_ERR_ALLOC_FAIL;
93+
goto out;
94+
}
95+
srk->key = key;
96+
@@ -440,6 +441,7 @@ sshsk_load_resident(const char *provider_path, const char *device,
97+
if ((tmp = recallocarray(srks, nsrks, nsrks + 1,
98+
sizeof(*srks))) == NULL) {
99+
error_f("recallocarray keys failed");
100+
+ r = SSH_ERR_ALLOC_FAIL;
101+
goto out;
102+
}
103+
debug_f("srks[%zu]: %s %s uidlen %zu", nsrks,
104+
diff --git a/sshconnect2.c b/sshconnect2.c
105+
index 9940833..9751b68 100644
106+
--- a/sshconnect2.c
107+
+++ b/sshconnect2.c
108+
@@ -94,7 +94,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
109+
options.required_rsa_size)) != 0)
110+
fatal_r(r, "Bad server host key");
111+
if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
112+
- xxx_conn_info) == -1)
113+
+ xxx_conn_info) != 0)
114+
fatal("Host key verification failed.");
115+
return 0;
116+
}
117+
@@ -692,6 +692,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
118+
119+
if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
120+
debug_f("server sent unknown pkalg %s", pkalg);
121+
+ r = SSH_ERR_INVALID_FORMAT;
122+
goto done;
123+
}
124+
if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
125+
@@ -702,6 +703,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
126+
error("input_userauth_pk_ok: type mismatch "
127+
"for decoded key (received %d, expected %d)",
128+
key->type, pktype);
129+
+ r = SSH_ERR_INVALID_FORMAT;
130+
goto done;
131+
}
132+
133+
@@ -721,6 +723,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, struct ssh *ssh)
134+
SSH_FP_DEFAULT);
135+
error_f("server replied with unknown key: %s %s",
136+
sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
137+
+ r = SSH_ERR_INVALID_FORMAT;
138+
goto done;
139+
}
140+
ident = format_identity(id);
141+
diff --git a/sshsig.c b/sshsig.c
142+
index 72bbf73..a88e939 100644
143+
--- a/sshsig.c
144+
+++ b/sshsig.c
145+
@@ -877,6 +877,7 @@ cert_filter_principals(const char *path, u_long linenum,
146+
}
147+
if ((principals = sshbuf_dup_string(nprincipals)) == NULL) {
148+
error_f("buffer error");
149+
+ r = SSH_ERR_ALLOC_FAIL;
150+
goto out;
151+
}
152+
/* success */

‎SPECS/openssh/CVE-2025-26466.nopatch‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
CVE-2025-26465.patch patches both CVE-2025-26465 and CVE-2025-26466.

‎SPECS/openssh/openssh.spec‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
Summary: Free version of the SSH connectivity tools
44
Name: openssh
55
Version: %{openssh_ver}
6-
Release: 2%{?dist}
6+
Release: 3%{?dist}
77
License: BSD
88
Vendor: Microsoft Corporation
99
Distribution: Azure Linux
@@ -32,6 +32,9 @@ Patch306: pam_ssh_agent_auth-0.10.2-compat.patch
3232
# Fix NULL dereference from getpwuid() return value
3333
# https://sourceforge.net/p/pamsshagentauth/bugs/22/
3434
Patch307: pam_ssh_agent_auth-0.10.2-dereference.patch
35+
#CVE Patches
36+
#This CVE Patches both CVE-2025-26465 and CVE-2025-26466
37+
Patch400: CVE-2025-26465.patch
3538
# sk-dummy.so built with -fvisibility=hidden does not work
3639
# The tests fail with the following error:
3740
# dlsym(sk_api_version) failed: (...)/sk-dummy.so: undefined symbol: sk_api_version
@@ -109,6 +112,7 @@ rm -f $(cat %{SOURCE4})
109112
autoreconf
110113
popd
111114

115+
%patch -P 400 -p1 -b .CVE-2025-26465.patch
112116
%patch -P 965 -p1 -b .visibility
113117

114118
%build
@@ -268,6 +272,9 @@ fi
268272
%{_mandir}/man8/ssh-sk-helper.8.gz
269273

270274
%changelog
275+
* Sun Feb 16 2025 Jon Slobodzian <joslobo@microsoft.com> - 9.8p1-3
276+
- Patch CVE-2025-26465 and CVE-2025-26466
277+
271278
* Fri Aug 16 2024 Pawel Winogrodzki <pawelwi@microsoft.com> - 9.8p1-2
272279
- Fixed 'openssh' ptests.
273280

0 commit comments

Comments
 (0)