From 8fe12bdb0ff1d82305c06f424abec7f16e4d3c21 Mon Sep 17 00:00:00 2001 From: Zoltan Fridrich Date: Fri, 21 Aug 2026 12:46:16 +0200 Subject: [PATCH] Fix CVE-2026-73281 Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245421 Signed-off-by: Zoltan Fridrich --- openssh-10.5p1-CVE-2026-73281.patch | 42 +++++++++++++++++++++++++++++ openssh.spec | 6 +++++ 2 files changed, 48 insertions(+) create mode 100644 openssh-10.5p1-CVE-2026-73281.patch diff --git a/openssh-10.5p1-CVE-2026-73281.patch b/openssh-10.5p1-CVE-2026-73281.patch new file mode 100644 index 0000000..b59ec35 --- /dev/null +++ b/openssh-10.5p1-CVE-2026-73281.patch @@ -0,0 +1,42 @@ +diff --git a/ssh-agent.c b/ssh-agent.c +--- a/ssh-agent.c ++++ b/ssh-agent.c +@@ -1839,8 +1839,17 @@ process_extension(SocketEntry *e) + error_fr(r, "parse"); + goto send; + } ++ ++ /* ++ * This function can be called while the agent is locked to allow ++ * session binds to be processed for new channels. ++ * Other operations should be refused when locked. ++ */ ++ + if (strcmp(name, "session-bind@openssh.com") == 0) + success = process_ext_session_bind(e); ++ else if (locked) ++ debug_f("attempt to use extension \"%s\" while locked", name); + else + debug_f("unsupported extension \"%s\"", name); + free(name); +@@ -1892,16 +1901,19 @@ process_message(u_int socknum) + + /* check whether agent is locked */ + if (locked && type != SSH_AGENTC_UNLOCK) { +- sshbuf_reset(e->request); + switch (type) { + case SSH2_AGENTC_REQUEST_IDENTITIES: + /* send empty lists */ + no_identities(e); + break; ++ case SSH_AGENTC_EXTENSION: ++ process_extension(e); ++ break; + default: + /* send a fail message for all other request types */ + send_status(e, 0); + } ++ sshbuf_reset(e->request); + return 1; + } + diff --git a/openssh.spec b/openssh.spec index 6d3a88b..08fe7ee 100644 --- a/openssh.spec +++ b/openssh.spec @@ -266,6 +266,8 @@ Patch1048: openssh-10.4p1-CVE-2026-59995.patch # combines CVE-2026-59999 and CVE-2026-73283 # downstream specific fix, drop on rebase Patch1049: openssh-10.4p1-CVE-2026-59999.patch +# upstream 6a57081dc35acf3ee298108d4bc3580489608d5f +Patch1050: openssh-10.5p1-CVE-2026-73281.patch License: BSD-3-Clause AND BSD-2-Clause AND ISC AND SSH-OpenSSH AND ssh-keyscan AND snprintf AND LicenseRef-Fedora-Public-Domain AND X11-distribute-modifications-variant Requires: /sbin/nologin @@ -479,6 +481,7 @@ gpgv2 --quiet --keyring %{SOURCE3} %{SOURCE1} %{SOURCE0} %patch -P 1047 -p1 -b .copy-data-ext-self-copy %patch -P 1048 -p1 -b .CVE-2026-59995 %patch -P 1049 -p1 -b .CVE-2026-59999 +%patch -P 1050 -p1 -b .CVE-2026-73281 %patch -P 100 -p1 -b .coverity @@ -763,6 +766,9 @@ test -f %{sysconfig_anaconda} && \ - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-242759 +- CVE-2026-73281: Fix misinteraction between agent locking and + the session-bind@openssh.com extension + Resolves: RHEL-245421 * Wed Aug 12 2026 Dmitry Belyavskiy - 9.9p1-29 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded