048ffad847
Resolves: RHEL-150661 Resolves: CVE-2025-4877 Resolves: CVE-2025-4878 Resolves: CVE-2025-5351 Resolves: CVE-2025-8114 Resolves: CVE-2025-8277 Resolves: CVE-2026-0964 Resolves: CVE-2026-0965 Resolves: CVE-2026-0966 Resolves: CVE-2026-0967 Resolves: CVE-2026-0968
46 lines
1.7 KiB
Diff
46 lines
1.7 KiB
Diff
From 7a76f6e268e4293e64358f65d1c253de5c40f875 Mon Sep 17 00:00:00 2001
|
|
From: Andreas Schneider <asn@cryptomilk.org>
|
|
Date: Wed, 6 Aug 2025 15:17:59 +0200
|
|
Subject: [PATCH] CVE-2025-8114: Fix NULL pointer dereference after allocation
|
|
failure
|
|
|
|
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
|
|
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
|
|
(cherry picked from commit 53ac23ded4cb2c5463f6c4cd1525331bd578812d)
|
|
---
|
|
src/kex.c | 4 ++++
|
|
1 file changed, 4 insertions(+)
|
|
|
|
diff --git a/src/kex.c b/src/kex.c
|
|
index f71482fd..64aacb9e 100644
|
|
--- a/src/kex.c
|
|
+++ b/src/kex.c
|
|
@@ -1494,6 +1494,8 @@ int ssh_make_sessionid(ssh_session session)
|
|
ssh_log_hexdump("hash buffer", ssh_buffer_get(buf), ssh_buffer_get_len(buf));
|
|
#endif
|
|
|
|
+ /* Set rc for the following switch statement in case we goto error. */
|
|
+ rc = SSH_ERROR;
|
|
switch (session->next_crypto->kex_type) {
|
|
case SSH_KEX_DH_GROUP1_SHA1:
|
|
case SSH_KEX_DH_GROUP14_SHA1:
|
|
@@ -1553,6 +1555,7 @@ int ssh_make_sessionid(ssh_session session)
|
|
session->next_crypto->secret_hash);
|
|
break;
|
|
}
|
|
+
|
|
/* During the first kex, secret hash and session ID are equal. However, after
|
|
* a key re-exchange, a new secret hash is calculated. This hash will not replace
|
|
* but complement existing session id.
|
|
@@ -1561,6 +1564,7 @@ int ssh_make_sessionid(ssh_session session)
|
|
session->next_crypto->session_id = malloc(session->next_crypto->digest_len);
|
|
if (session->next_crypto->session_id == NULL) {
|
|
ssh_set_error_oom(session);
|
|
+ rc = SSH_ERROR;
|
|
goto error;
|
|
}
|
|
memcpy(session->next_crypto->session_id, session->next_crypto->secret_hash,
|
|
--
|
|
2.53.0
|
|
|