已开启
fix CVE-2025-8114 #104
AtomGit-Bot创建于 2025年9月10日
fix CVE-2025-8114 #104
已开启
从refs/pull/104/head合入到openEuler-24.03-LTS
共 2 个文件变更+50-1
| @@ -0,0 +1,43 @@ | |||
| 1 | +From 53ac23ded4cb2c5463f6c4cd1525331bd578812d Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Andreas Schneider <asn@cryptomilk.org> | ||
| 3 | +Date: Wed, 6 Aug 2025 15:17:59 +0200 | ||
| 4 | +Subject: CVE-2025-8114: Fix NULL pointer dereference after allocation failure | ||
| 5 | + | ||
| 6 | +Signed-off-by: Andreas Schneider <asn@cryptomilk.org> | ||
| 7 | +Reviewed-by: Jakub Jelen <jjelen@redhat.com> | ||
| 8 | +--- | ||
| 9 | + src/kex.c | 4 ++++ | ||
| 10 | + 1 file changed, 4 insertions(+) | ||
| 11 | + | ||
| 12 | +diff --git a/src/kex.c b/src/kex.c | ||
| 13 | +index f1c1b014..02f2735f 100644 | ||
| 14 | +--- a/src/kex.c | ||
| 15 | ++++ b/src/kex.c | ||
| 16 | + int ssh_make_sessionid(ssh_session session) | ||
| 17 | + ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf)); | ||
| 18 | + #endif | ||
| 19 | + | ||
| 20 | ++ /* Set rc for the following switch statement in case we goto error. */ | ||
| 21 | ++ rc = SSH_ERROR; | ||
| 22 | + switch (session->next_crypto->kex_type) { | ||
| 23 | + case SSH_KEX_DH_GROUP1_SHA1: | ||
| 24 | + case SSH_KEX_DH_GROUP14_SHA1: | ||
| 25 | + int ssh_make_sessionid(ssh_session session) | ||
| 26 | + session->next_crypto->secret_hash); | ||
| 27 | + break; | ||
| 28 | + } | ||
| 29 | ++ | ||
| 30 | + /* During the first kex, secret hash and session ID are equal. However, after | ||
| 31 | + * a key re-exchange, a new secret hash is calculated. This hash will not replace | ||
| 32 | + * but complement existing session id. | ||
| 33 | + int ssh_make_sessionid(ssh_session session) | ||
| 34 | + session->next_crypto->session_id = malloc(session->next_crypto->digest_len); | ||
| 35 | + if (session->next_crypto->session_id == NULL) { | ||
| 36 | + ssh_set_error_oom(session); | ||
| 37 | ++ rc = SSH_ERROR; | ||
| 38 | + goto error; | ||
| 39 | + } | ||
| 40 | + memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash, | ||
| 41 | +-- | ||
| 42 | +cgit v1.2.3 | ||
| 43 | + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: libssh | 1 | Name: libssh |
| 2 | Version: 0.10.5 | 2 | Version: 0.10.5 |
| 3 | -Release: 5 | 3 | +Release: 6 |
| 4 | Summary: A library implementing the SSH protocol | 4 | Summary: A library implementing the SSH protocol |
| 5 | License: LGPLv2+ | 5 | License: LGPLv2+ |
| 6 | URL: http://www.libssh.org | 6 | URL: http://www.libssh.org |
| @@ -37,6 +37,9 @@ Patch25: backport-0024-CVE-2025-5351-avoid-double-free-on-low-memory-cond | |||
| 37 | Patch26: backport-0025-CVE-2025-5987-correctly-detect-failures-of-chacha-init.patch | 37 | Patch26: backport-0025-CVE-2025-5987-correctly-detect-failures-of-chacha-init.patch |
| 38 | Patch27: backport-0026-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch | 38 | Patch27: backport-0026-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch |
| 39 | 39 | ||
| 40 | +#Reference: https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d | ||
| 41 | +Patch28: backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch | ||
| 42 | + | ||
| 40 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel | 43 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel |
| 41 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server | 44 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server |
| 42 | BuildRequires: nmap-ncat | 45 | BuildRequires: nmap-ncat |
| @@ -121,6 +124,9 @@ popd | |||
| 121 | %doc CHANGELOG README | 124 | %doc CHANGELOG README |
| 122 | 125 | ||
| 123 | %changelog | 126 | %changelog |
| 127 | +* Wed Sep 10 2025 Zhang Yi <yizhang@cqsoftware.com.cn> - 0.10.5-6 | ||
| 128 | +- fix CVE-2025-8114 | ||
| 129 | + | ||
| 124 | * Mon Aug 18 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5 | 130 | * Mon Aug 18 2025 zhangbinqin <zhangbinqin@h-partners.com> - 0.10.5-5 |
| 125 | - Type:CVE | 131 | - Type:CVE |
| 126 | - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372 | 132 | - Id:CVE-2025-4877 CVE-2025-4878 CVE-2025-5351 CVE-2025-5987 CVE-2025-5372 |