已开启
fix CVE-2025-8114 #105
AtomGit-Bot创建于 2025年9月10日
fix CVE-2025-8114 #105
已开启
从refs/pull/105/head合入到openEuler-22.03-LTS-SP4
共 2 个文件变更+48-1
| @@ -0,0 +1,43 @@ | |||
| 1 | +From 53ac23ded4cb2c5463f6c4cd1525331bd578812d Mon Sep 17 00:00:00 2001 | ||
| 2 | +From: Andreas Schneider <asn@cryptomilk.org> | ||
| 3 | +Date: Wed, 6 Aug 2025 15:17:59 +0200 | ||
| 4 | +Subject: CVE-2025-8114: Fix NULL pointer dereference after allocation failure | ||
| 5 | + | ||
| 6 | +Signed-off-by: Andreas Schneider <asn@cryptomilk.org> | ||
| 7 | +Reviewed-by: Jakub Jelen <jjelen@redhat.com> | ||
| 8 | +--- | ||
| 9 | + src/kex.c | 4 ++++ | ||
| 10 | + 1 file changed, 4 insertions(+) | ||
| 11 | + | ||
| 12 | +diff --git a/src/kex.c b/src/kex.c | ||
| 13 | +index f1c1b014..02f2735f 100644 | ||
| 14 | +--- a/src/kex.c | ||
| 15 | ++++ b/src/kex.c | ||
| 16 | + int ssh_make_sessionid(ssh_session session) | ||
| 17 | + ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf)); | ||
| 18 | + #endif | ||
| 19 | + | ||
| 20 | ++ /* Set rc for the following switch statement in case we goto error. */ | ||
| 21 | ++ rc = SSH_ERROR; | ||
| 22 | + switch (session->next_crypto->kex_type) { | ||
| 23 | + case SSH_KEX_DH_GROUP1_SHA1: | ||
| 24 | + case SSH_KEX_DH_GROUP14_SHA1: | ||
| 25 | + int ssh_make_sessionid(ssh_session session) | ||
| 26 | + session->next_crypto->secret_hash); | ||
| 27 | + break; | ||
| 28 | + } | ||
| 29 | ++ | ||
| 30 | + /* During the first kex, secret hash and session ID are equal. However, after | ||
| 31 | + * a key re-exchange, a new secret hash is calculated. This hash will not replace | ||
| 32 | + * but complement existing session id. | ||
| 33 | + int ssh_make_sessionid(ssh_session session) | ||
| 34 | + session->next_crypto->session_id = malloc(session->next_crypto->digest_len); | ||
| 35 | + if (session->next_crypto->session_id == NULL) { | ||
| 36 | + ssh_set_error_oom(session); | ||
| 37 | ++ rc = SSH_ERROR; | ||
| 38 | + goto error; | ||
| 39 | + } | ||
| 40 | + memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash, | ||
| 41 | +-- | ||
| 42 | +cgit v1.2.3 | ||
| 43 | + | ||
| @@ -1,6 +1,6 @@ | |||
| 1 | Name: libssh | 1 | Name: libssh |
| 2 | Version: 0.9.6 | 2 | Version: 0.9.6 |
| 3 | -Release: 11 | 3 | +Release: 12 |
| 4 | Summary: A library implementing the SSH protocol | 4 | Summary: A library implementing the SSH protocol |
| 5 | License: LGPLv2+ | 5 | License: LGPLv2+ |
| 6 | URL: http://www.libssh.org | 6 | URL: http://www.libssh.org |
| @@ -65,6 +65,7 @@ Patch52: backport-CVE-2025-4878-fix-uninitialized-variable-part1.patch | |||
| 65 | Patch53: backport-CVE-2025-4878-fix-uninitialized-variable-part2.patch | 65 | Patch53: backport-CVE-2025-4878-fix-uninitialized-variable-part2.patch |
| 66 | Patch54: backport-CVE-2025-5372-pre-Reformat-ssh_kdf.patch | 66 | Patch54: backport-CVE-2025-5372-pre-Reformat-ssh_kdf.patch |
| 67 | Patch55: backport-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch | 67 | Patch55: backport-CVE-2025-5372-Simplify-error-checking-in-ssh_kdf.patch |
| 68 | +Patch56: backport-0027-CVE-2025-8114-Fix-NULL-pointer-dereference-after-allocation-failure.patch | ||
| 68 | 69 | ||
| 69 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel | 70 | BuildRequires: cmake gcc-c++ gnupg2 openssl-devel pkgconfig zlib-devel |
| 70 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server | 71 | BuildRequires: krb5-devel libcmocka-devel openssh-clients openssh-server |
| @@ -150,6 +151,9 @@ popd | |||
| 150 | %doc ChangeLog README | 151 | %doc ChangeLog README |
| 151 | 152 | ||
| 152 | %changelog | 153 | %changelog |
| 154 | +* Wed Sep 10 2025 Zhang Yi <yizhang@cqsoftware.com.cn> - 0.9.6-12 | ||
| 155 | +- fix CVE-2025-8114 | ||
| 156 | + | ||
| 153 | * Wed Aug 27 2025 gaihuiying <eaglegai@163.com> - 0.9.6-11 | 157 | * Wed Aug 27 2025 gaihuiying <eaglegai@163.com> - 0.9.6-11 |
| 154 | - Type:CVE | 158 | - Type:CVE |
| 155 | - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372 | 159 | - CVE:CVE-2025-4877 CVE-2025-4878 CVE-2025-5372 |