a97adc51f9
Resolves: RHEL-215674 Resolves: RHEL-215675 Resolves: RHEL-215676 Resolves: RHEL-215677 Resolves: RHEL-215678 Resolves: RHEL-215679 Resolves: RHEL-215680 Assisted-by: Ymir
34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From 5f8c72ac1d3ebf87de088e08035dafbab3fb23ee Mon Sep 17 00:00:00 2001
|
|
From: Jakub Jelen <jjelen@redhat.com>
|
|
Date: Wed, 1 Jul 2026 16:43:08 +0200
|
|
Subject: [PATCH] CVE-2026-59850 channels: Avoid processing DATA packets on
|
|
closed channels
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Signed-off-by: Jakub Jelen <jjelen@redhat.com>
|
|
Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
|
|
---
|
|
src/channels.c | 7 +++++++
|
|
1 file changed, 7 insertions(+)
|
|
|
|
diff --git a/src/channels.c b/src/channels.c
|
|
index 36e19598..88430791 100644
|
|
--- a/src/channels.c
|
|
+++ b/src/channels.c
|
|
@@ -563,6 +563,13 @@ SSH_PACKET_CALLBACK(channel_rcv_data){
|
|
channel->local_window,
|
|
channel->remote_window);
|
|
|
|
+ if (channel->flags & SSH_CHANNEL_FLAG_CLOSED_REMOTE) {
|
|
+ SSH_LOG(SSH_LOG_WARNING, "Received data on (remotely) closed channel");
|
|
+ ssh_set_error(session, SSH_FATAL, "Received data on (remotely) closed channel");
|
|
+ SSH_STRING_FREE(str);
|
|
+ return SSH_PACKET_USED;
|
|
+ }
|
|
+
|
|
/* What shall we do in this case? Let's accept it anyway */
|
|
if (len > channel->local_window) {
|
|
SSH_LOG(SSH_LOG_RARE,
|