REDHAT-BUG-2506860: Medium severity libssh2 libssh2 vulnerability
libssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-bounds read and a free of an uninitialized pointer via the publickey subsystem. In libssh2publickeylistfetch(), the version 1 response parser reads a server-controlled commentlen value and advances the parse pointer without verifying sufficient bytes remain in the buffer, causing the out-of-bounds read to leak heap pointers from adjacent allocations defeating ASLR, followed by heap allocator state corruption when the error cleanup path frees an uninitialized pointer from a non-zeroed realloc() region.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Patch a13bb6c - Upgrade
Upgrade
libssh2to a version that resolves this vulnerability.Fixed in 1.11.1
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
The attacker must operate or control a malicious SSH server that can send a crafted version 1 publickey response. The vulnerable client must reach libssh2_publickey_list_fetch() through the publickey subsystem.
Which libssh2 versions are affected?
The issue affects libssh2 through version 1.11.1. The provided information identifies commit a13bb6c as the fix.
What is the likely impact of successful exploitation?
A crafted response can cause an arbitrary-length heap out-of-bounds read that may disclose adjacent heap pointers and weaken ASLR. The error cleanup path can also free an uninitialized pointer, potentially corrupting heap allocator state.