From 2cadce746cb11c4505967cba82aef7c102901191 Mon Sep 17 00:00:00 2001
From: Andrew Lukoshko <alukoshko@almalinux.org>
Date: Wed, 19 Feb 2025 15:48:29 +0000
Subject: [PATCH] Correct error code processing - CVE-2025-26465

---
 SOURCES/openssh-9.9p2-CVE-2025-26465.patch | 56 ++++++++++++++++++++++
 SPECS/openssh.spec                         | 13 ++++-
 2 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 SOURCES/openssh-9.9p2-CVE-2025-26465.patch

diff --git a/SOURCES/openssh-9.9p2-CVE-2025-26465.patch b/SOURCES/openssh-9.9p2-CVE-2025-26465.patch
new file mode 100644
index 0000000..c55e3d3
--- /dev/null
+++ b/SOURCES/openssh-9.9p2-CVE-2025-26465.patch
@@ -0,0 +1,56 @@
+Description: fix MitM with VerifyHostKeyDNS option
+Origin: backported from patch provided by upstream to Qualys
+
+--- a/krl.c
++++ b/krl.c
+@@ -677,6 +677,7 @@ revoked_certs_generate(struct revoked_ce
+ 			break;
+ 		case KRL_SECTION_CERT_SERIAL_BITMAP:
+ 			if (rs->lo - bitmap_start > INT_MAX) {
++				r = SSH_ERR_INVALID_FORMAT;
+ 				error("%s: insane bitmap gap", __func__);
+ 				goto out;
+ 			}
+@@ -1012,6 +1013,7 @@ ssh_krl_from_blob(struct sshbuf *buf, st
+ 		goto out;
+ 
+ 	if ((krl = ssh_krl_init()) == NULL) {
++		r = SSH_ERR_ALLOC_FAIL;
+ 		error("%s: alloc failed", __func__);
+ 		goto out;
+ 	}
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -95,7 +95,7 @@ struct sockaddr *xxx_hostaddr;
+ static int
+ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ {
+-	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
++	if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) != 0)
+ 		fatal("Host key verification failed.");
+ 	return 0;
+ }
+@@ -756,6 +756,7 @@ input_userauth_pk_ok(int type, u_int32_t
+ 
+ 	if ((pktype = sshkey_type_from_name(pkalg)) == KEY_UNSPEC) {
+ 		debug("%s: server sent unknown pkalg %s", __func__, pkalg);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
+@@ -766,6 +767,7 @@ input_userauth_pk_ok(int type, u_int32_t
+ 		error("input_userauth_pk_ok: type mismatch "
+ 		    "for decoded key (received %d, expected %d)",
+ 		    key->type, pktype);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 
+@@ -785,6 +787,7 @@ input_userauth_pk_ok(int type, u_int32_t
+ 		    SSH_FP_DEFAULT);
+ 		error("%s: server replied with unknown key: %s %s", __func__,
+ 		    sshkey_type(key), fp == NULL ? "<ERROR>" : fp);
++		r = SSH_ERR_INVALID_FORMAT;
+ 		goto done;
+ 	}
+ 	ident = format_identity(id);
diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec
index a07dbd3..a0469bf 100644
--- a/SPECS/openssh.spec
+++ b/SPECS/openssh.spec
@@ -73,7 +73,7 @@
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}%{?rescue_rel}
+Release: %{openssh_rel}%{?dist}%{?rescue_rel}.alma.1
 URL: http://www.openssh.com/portable.html
 #URL1: http://pamsshagentauth.sourceforge.net
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
@@ -294,6 +294,9 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
 Patch1020: openssh-8.7p1-scp-kill-switch.patch
 #upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
 Patch1021: openssh-8.0p1-upstream-ignore-SIGPIPE.patch
+# upstream commit 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
+# upstream commit 0832aac79517611dd4de93ad0a83577994d9c907
+Patch1022: openssh-9.9p2-CVE-2025-26465.patch
 
 License: BSD
 Group: Applications/Internet
@@ -543,6 +546,8 @@ popd
 %patch1020 -p1 -b .scp-kill-switch
 %patch1021 -p1 -b .ignore-SIGPIPE
 
+%patch1022 -p1 -b .cve-2025-26465
+
 autoreconf
 pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
 autoreconf
@@ -827,6 +832,12 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Wed Feb 19 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 8.0p1-25.alma.1
+- Fix missing error codes set and invalid error code checks in OpenSSH. It
+  prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
+  is on (CVE-2025-26465).
+  Resolves: RHEL-78700
+
 * Tue Jun 25 2024 Stepan Broz <sbroz@redhat.com> - 8.0p1-25
 - Upstream: Ignore SIGPIPE earlier in main()
   Resolves: RHEL-37743