public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Zoltan Fridrich <zfridric@redhat.com>
To: git-commits@fedoraproject.org
Subject: [rpms/openssh] f43: Fix CVE-2026-60002
Date: Fri, 17 Jul 2026 13:34:20 GMT	[thread overview]
Message-ID: <178429526058.1.15399138344242144602.rpms-openssh-e1dfb3f280c8@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : rpms/openssh
            Branch : f43
            Commit : e1dfb3f280c87f464094df71c52b617bf8e536dd
            Author : Zoltan Fridrich <zfridric@redhat.com>
            Date   : 2026-07-17T11:49:50+02:00
            Stats  : +195/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/openssh/c/e1dfb3f280c87f464094df71c52b617bf8e536dd?branch=f43

            Log:
            Fix CVE-2026-60002

Fix use-after-free in cached hostkey during key re-exchange

Resolves: rhbz#2497966

Signed-off-by: Zoltan Fridrich <zfridric@redhat.com>

---
diff --git a/0061-openssh-9.9p1-cve-2026-60002.patch b/0061-openssh-9.9p1-cve-2026-60002.patch
new file mode 100644
index 0000000..ab16479
--- /dev/null
+++ b/0061-openssh-9.9p1-cve-2026-60002.patch
@@ -0,0 +1,191 @@
+diff --color -ruNp a/ssh.c b/ssh.c
+--- a/ssh.c	2026-07-14 11:58:09.036496915 +0200
++++ b/ssh.c	2026-07-14 12:00:55.044542741 +0200
+@@ -619,26 +619,6 @@ set_addrinfo_port(struct addrinfo *addrs
+ 	}
+ }
+ 
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+-	if (cinfo == NULL)
+-		return;
+-	free(cinfo->conn_hash_hex);
+-	free(cinfo->shorthost);
+-	free(cinfo->uidstr);
+-	free(cinfo->keyalias);
+-	free(cinfo->thishost);
+-	free(cinfo->host_arg);
+-	free(cinfo->portstr);
+-	free(cinfo->remhost);
+-	free(cinfo->remuser);
+-	free(cinfo->homedir);
+-	free(cinfo->locuser);
+-	free(cinfo->jmphost);
+-	free(cinfo);
+-}
+-
+ /*
+  * Main program for the ssh client.
+  */
+@@ -1765,8 +1745,8 @@ main(int ac, char **av)
+ 	ssh_signal(SIGCHLD, main_sigchld_handler);
+ 
+ 	/* Log into the remote system.  Never returns if the login fails. */
+-	ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+-	    options.port, pw, timeout_ms, cinfo);
++	ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++	    pw, timeout_ms, cinfo);
+ 
+ 	/* We no longer need the private host keys.  Clear them now. */
+ 	if (sensitive_data.nkeys != 0) {
+diff --color -ruNp a/sshconnect2.c b/sshconnect2.c
+--- a/sshconnect2.c	2026-07-14 11:58:09.031477028 +0200
++++ b/sshconnect2.c	2026-07-14 12:01:56.374803123 +0200
+@@ -89,7 +89,7 @@ extern Options options;
+  */
+ 
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+ 
+@@ -105,7 +105,7 @@ verify_host_key_callback(struct sshkey *
+ 		fatal("Server host key %s not in HostKeyAlgorithms",
+ 		    sshkey_ssh_name(hostkey));
+ 	}
+-	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++	if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ 	    xxx_conn_info) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+@@ -222,8 +222,8 @@ order_hostkeyalgs(char *host, struct soc
+ }
+ 
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+-    const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++    u_short port, const struct ssh_conn_info *cinfo)
+ {
+ 	char *myproposal[PROPOSAL_MAX];
+ 	char *all_key, *hkalgs = NULL, *filtered_algs = NULL;
+@@ -234,9 +234,9 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ 	char *gss_host = NULL;
+ #endif
+ 
+-	xxx_host = host;
+-	xxx_hostaddr = hostaddr;
+-	xxx_conn_info = cinfo;
++	xxx_host = xstrdup(host);
++	xxx_hostaddr = *hostaddr;
++	xxx_conn_info = ssh_conn_info_dup(cinfo);
+ 
+ 	if (options.rekey_limit || options.rekey_interval)
+ 		ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -259,8 +259,10 @@ ssh_kex2(struct ssh *ssh, char *host, st
+ 		fatal_fr(r, "kex_assemble_namelist");
+ 	free(all_key);
+ 
+-	if (use_known_hosts_order)
+-		hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++	if (use_known_hosts_order) {
++		hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++		    port, cinfo);
++	}
+ 
+ 	filtered_algs = hkalgs ? match_filter_allowlist(hkalgs, options.pubkey_accepted_algos)
+ 		               : match_filter_allowlist(options.hostkeyalgorithms,
+diff --color -ruNp a/sshconnect.c b/sshconnect.c
+--- a/sshconnect.c	2026-07-14 11:58:08.892659011 +0200
++++ b/sshconnect.c	2026-07-14 12:00:55.045767462 +0200
+@@ -84,6 +84,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+ 
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++	if (cinfo == NULL)
++		return;
++	free(cinfo->conn_hash_hex);
++	free(cinfo->shorthost);
++	free(cinfo->uidstr);
++	free(cinfo->keyalias);
++	free(cinfo->thishost);
++	free(cinfo->host_arg);
++	free(cinfo->portstr);
++	free(cinfo->remhost);
++	free(cinfo->remuser);
++	free(cinfo->homedir);
++	free(cinfo->locuser);
++	free(cinfo->jmphost);
++	freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++	struct ssh_conn_info *ret;
++
++	if (cinfo == NULL)
++		return NULL;
++	ret = xcalloc(1, sizeof(*ret));
++	ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++	ret->shorthost = xstrdup(cinfo->shorthost);
++	ret->uidstr = xstrdup(cinfo->uidstr);
++	ret->keyalias = xstrdup(cinfo->keyalias);
++	ret->thishost = xstrdup(cinfo->thishost);
++	ret->host_arg = xstrdup(cinfo->host_arg);
++	ret->portstr = xstrdup(cinfo->portstr);
++	ret->remhost = xstrdup(cinfo->remhost);
++	ret->remuser = xstrdup(cinfo->remuser);
++	ret->homedir = xstrdup(cinfo->homedir);
++	ret->locuser = xstrdup(cinfo->locuser);
++	ret->jmphost = xstrdup(cinfo->jmphost);
++	return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1589,8 +1632,8 @@ out:
+  */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+-    struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+-    const struct ssh_conn_info *cinfo)
++    struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++    int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ 	char *host;
+ 	char *server_user, *local_user;
+diff --color -ruNp a/sshconnect.h b/sshconnect.h
+--- a/sshconnect.h	2024-09-20 00:20:48.000000000 +0200
++++ b/sshconnect.h	2026-07-14 12:00:55.045948953 +0200
+@@ -73,7 +73,7 @@ int	 ssh_connect(struct ssh *, const cha
+ void	 ssh_kill_proxy_command(void);
+ 
+ void	 ssh_login(struct ssh *, Sensitive *, const char *,
+-    struct sockaddr *, u_short, struct passwd *, int,
++    struct sockaddr_storage *, u_short, struct passwd *, int,
+     const struct ssh_conn_info *);
+ 
+ int	 verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -82,7 +82,7 @@ int	 verify_host_key(char *, struct sock
+ void	 get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+     char **, char **);
+ 
+-void	 ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void	 ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+     const struct ssh_conn_info *);
+ 
+ void	 ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -98,3 +98,6 @@ void	 load_hostkeys_command(struct hostk
+     const struct sshkey *, const char *);
+ 
+ int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);

diff --git a/openssh.spec b/openssh.spec
index 35c35bd..dbdcf01 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -196,6 +196,8 @@ Patch0058: 0058-openssh-9.9p1-reject-null-char-in-url-string.patch
 Patch0059: 0059-openssh-10.0p1-reject-cntrl-chars-in-username.patch
 # upstream 36480181fa22f98e180b4f9e10203480c0346c78
 Patch0060: 0060-openssh-9.9p1-scp-remote-glob.patch
+# upstream e8bdfb151a356d0171fea4194dd205fbb252be23
+Patch0061: 0061-openssh-9.9p1-cve-2026-60002.patch
 
 #https://bugzilla.mindrot.org/show_bug.cgi?id=2581
 Patch1000: 1000-openssh-coverity.patch
@@ -605,6 +607,8 @@ test -f %{sysconfig_anaconda} && \
   in unintended parent directories when scp performs remote-to-remote copy
   via the local host
   Resolves: rhbz#2498027
+- CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange
+  Resolves: rhbz#2497966
 
 * Tue Jul 07 2026 Zoltan Fridrich <zfridric@redhat.com> - 10.0p1-10
 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during

                 reply	other threads:[~2026-07-17 13:34 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178429526058.1.15399138344242144602.rpms-openssh-e1dfb3f280c8@fedoraproject.org \
    --to=zfridric@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox