|
| 1 | +From 82e574ecb3fd33a4eb564742966f01704084692e Mon Sep 17 00:00:00 2001 |
| 2 | +From: Sudipta Pandit <sudpandit@microsoft.com> |
| 3 | +Date: Tue, 11 Mar 2025 00:17:38 +0530 |
| 4 | +Subject: [PATCH] Backport upstream patch for CVE-2025-22869.patch |
| 5 | + |
| 6 | +--- |
| 7 | + vendor/golang.org/x/crypto/ssh/handshake.go | 30 +++++++++++++++++---- |
| 8 | + 1 file changed, 25 insertions(+), 5 deletions(-) |
| 9 | + |
| 10 | +diff --git a/vendor/golang.org/x/crypto/ssh/handshake.go b/vendor/golang.org/x/crypto/ssh/handshake.go |
| 11 | +index 653dc4d..a1e1536 100644 |
| 12 | +--- a/vendor/golang.org/x/crypto/ssh/handshake.go |
| 13 | ++++ b/vendor/golang.org/x/crypto/ssh/handshake.go |
| 14 | +@@ -24,6 +24,11 @@ const debugHandshake = false |
| 15 | + // quickly. |
| 16 | + const chanSize = 16 |
| 17 | + |
| 18 | ++// maxPendingPackets sets the maximum number of packets to queue while waiting |
| 19 | ++// for KEX to complete. This limits the total pending data to maxPendingPackets |
| 20 | ++// * maxPacket bytes, which is ~16.8MB. |
| 21 | ++const maxPendingPackets = 64 |
| 22 | ++ |
| 23 | + // keyingTransport is a packet based transport that supports key |
| 24 | + // changes. It need not be thread-safe. It should pass through |
| 25 | + // msgNewKeys in both directions. |
| 26 | +@@ -59,6 +64,7 @@ type handshakeTransport struct { |
| 27 | + readError error |
| 28 | + |
| 29 | + mu sync.Mutex |
| 30 | ++ writeCond *sync.Cond |
| 31 | + writeError error |
| 32 | + sentInitPacket []byte |
| 33 | + sentInitMsg *kexInitMsg |
| 34 | +@@ -112,6 +118,7 @@ func newHandshakeTransport(conn keyingTransport, config *Config, clientVersion, |
| 35 | + |
| 36 | + config: config, |
| 37 | + } |
| 38 | ++ t.writeCond = sync.NewCond(&t.mu) |
| 39 | + t.resetReadThresholds() |
| 40 | + t.resetWriteThresholds() |
| 41 | + |
| 42 | +@@ -234,6 +241,7 @@ func (t *handshakeTransport) recordWriteError(err error) { |
| 43 | + defer t.mu.Unlock() |
| 44 | + if t.writeError == nil && err != nil { |
| 45 | + t.writeError = err |
| 46 | ++ t.writeCond.Broadcast() |
| 47 | + } |
| 48 | + } |
| 49 | + |
| 50 | +@@ -337,6 +345,8 @@ write: |
| 51 | + } |
| 52 | + } |
| 53 | + t.pendingPackets = t.pendingPackets[:0] |
| 54 | ++ // Unblock writePacket if waiting for KEX. |
| 55 | ++ t.writeCond.Broadcast() |
| 56 | + t.mu.Unlock() |
| 57 | + } |
| 58 | + |
| 59 | +@@ -518,11 +528,20 @@ func (t *handshakeTransport) writePacket(p []byte) error { |
| 60 | + } |
| 61 | + |
| 62 | + if t.sentInitMsg != nil { |
| 63 | +- // Copy the packet so the writer can reuse the buffer. |
| 64 | +- cp := make([]byte, len(p)) |
| 65 | +- copy(cp, p) |
| 66 | +- t.pendingPackets = append(t.pendingPackets, cp) |
| 67 | +- return nil |
| 68 | ++ if len(t.pendingPackets) < maxPendingPackets { |
| 69 | ++ // Copy the packet so the writer can reuse the buffer. |
| 70 | ++ cp := make([]byte, len(p)) |
| 71 | ++ copy(cp, p) |
| 72 | ++ t.pendingPackets = append(t.pendingPackets, cp) |
| 73 | ++ return nil |
| 74 | ++ } |
| 75 | ++ for t.sentInitMsg != nil { |
| 76 | ++ // Block and wait for KEX to complete or an error. |
| 77 | ++ t.writeCond.Wait() |
| 78 | ++ if t.writeError != nil { |
| 79 | ++ return t.writeError |
| 80 | ++ } |
| 81 | ++ } |
| 82 | + } |
| 83 | + |
| 84 | + if t.writeBytesLeft > 0 { |
| 85 | +@@ -539,6 +558,7 @@ func (t *handshakeTransport) writePacket(p []byte) error { |
| 86 | + |
| 87 | + if err := t.pushPacket(p); err != nil { |
| 88 | + t.writeError = err |
| 89 | ++ t.writeCond.Broadcast() |
| 90 | + } |
| 91 | + |
| 92 | + return nil |
| 93 | +-- |
| 94 | +2.34.1 |
| 95 | + |
0 commit comments