microsoft · azurelinux-security · Jul 28, 2026 · Jul 28, 2026
@@ -0,0 +1,63 @@
+From 65a8b74257154acc6ba80e861c4d885cfa77afb0 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 28 Jul 2026 06:56:03 +0000
+Subject: [PATCH] channels: Fail when receiving max packet size 0
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://git.libssh.org/projects/libssh.git/patch/?id=44b186fa17aff497dae420c59c003222e438103c
+---
+ src/channels.c |  7 +++++++
+ src/messages.c | 19 +++++++++++++++----
+ 2 files changed, 22 insertions(+), 4 deletions(-)
+
+diff --git a/src/channels.c b/src/channels.c
+index 52d001b..6276323 100644
+--- a/src/channels.c
++++ b/src/channels.c
+@@ -192,6 +192,13 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open_conf){
+   if (rc != SSH_OK)
+       goto error;
+
++  if (channel->remote_maxpacket == 0) {
++      SSH_LOG(SSH_LOG_RARE,
++              "Invalid maximum packet size 0 in "
++              "SSH2_MSG_CHANNEL_OPEN_CONFIRMATION");
++      goto error;
++  }
++
+   SSH_LOG(SSH_LOG_PROTOCOL,
+       "Received a CHANNEL_OPEN_CONFIRMATION for channel %d:%d",
+       channel->local_channel,
+diff --git a/src/messages.c b/src/messages.c
+index 6dadabf..e79ecec 100644
+--- a/src/messages.c
++++ b/src/messages.c
+@@ -1160,10 +1160,21 @@ SSH_PACKET_CALLBACK(ssh_packet_channel_open){
+   SSH_LOG(SSH_LOG_PACKET,
+       "Clients wants to open a %s channel", type_c);
+
+-  ssh_buffer_unpack(packet,"ddd",
+-          &msg->channel_request_open.sender,
+-          &msg->channel_request_open.window,
+-          &msg->channel_request_open.packet_size);
++  rc = ssh_buffer_unpack(packet,
++                         "ddd",
++                         &msg->channel_request_open.sender,
++                         &msg->channel_request_open.window,
++                         &msg->channel_request_open.packet_size);
++  if (rc != SSH_OK){
++      goto error;
++  }
++
++  if (msg->channel_request_open.packet_size == 0) {
++      ssh_set_error(session,
++                    SSH_FATAL,
++                    "Invalid maximum packet size 0 in SSH2_MSG_CHANNEL_OPEN");
++      goto error;
++  }
+
+   if (session->session_state != SSH_SESSION_STATE_AUTHENTICATED){
+     ssh_set_error(session,SSH_FATAL, "Invalid state when receiving channel open request (must be authenticated)");
+-- 
+2.45.4
+
@@ -0,0 +1,46 @@
+From 7f039ce9852b5ee29c1438137ada1db7f1a6a69e Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavol=20=C5=BD=C3=A1=C4=8Dik?= <pzacik@redhat.com>
+Date: Fri, 6 Mar 2026 18:05:29 +0100
+Subject: [PATCH] CVE-2026-59844 sftpserver: cap accepted values of len in
+ SSH_FXP_READ
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The client-provided length is directly used in
+a malloc in process_read(), so not restricting it
+leads to allocations bounded only by UINT32_MAX.
+
+The new cap is the same as the one currently used
+by OpenSSH.
+
+Signed-off-by: Pavol Žáčik <pzacik@redhat.com>
+Reviewed-by: Jakub Jelen <jjelen@redhat.com>
+(cherry picked from commit 6dba2e06f0713c04ad5eca7d4315d0104be7e627)
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://git.libssh.org/projects/libssh.git/patch/?id=2544f22733ffcd59a2e51e2950f80901d063b946
+---
+ src/sftpserver.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/sftpserver.c b/src/sftpserver.c
+index 528ef6f..d2352c0 100644
+--- a/src/sftpserver.c
++++ b/src/sftpserver.c
+@@ -143,6 +143,13 @@ sftp_client_message sftp_get_client_message(sftp_session sftp) {
+         sftp_client_message_free(msg);
+         return NULL;
+       }
++            if (msg->len > MAX_PACKET_LEN - 1024) {
++                ssh_set_error(sftp->session,
++                              SSH_FATAL,
++                              "Too large SSH_FXP_READ length: %" PRIu32,
++                              msg->len);
++                goto error;
++            }
+       break;
+     case SSH_FXP_MKDIR:
+     case SSH_FXP_SETSTAT:
+-- 
+2.45.4
+
@@ -0,0 +1,67 @@
+From e27315bb88e155a8bdcab162f87b6cb7894403ec Mon Sep 17 00:00:00 2001
+From: Jakub Jelen <jjelen@redhat.com>
+Date: Thu, 26 Mar 2026 16:32:24 +0100
+Subject: [PATCH] CVE-2026-59845 socket: Properly check fork() return code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+During execution of proxy command, when fork() fails, its return value
+is stored in pid and when the parent process attempts to kill it,
+it sends the kill signal to all processes the calling application has
+access to (except for init).
+
+This caused nard to debug issues when the system under the load was hitting
+fork failures, which resulted in killing of all the system processes
+(of given user).
+
+Reported and first patch iteration provided by: Halil Oktay (oblivionsage).
+
+This code missing fork return value check is in libssh since 2010
+(f31a14b7932ef4cc165ddd8f1f1a5b23eb21beb3), but this issue is exploitable only
+since libssh 0.9.0 as previously there was no implementation of killing
+ProxyCommand children.
+
+Signed-off-by: Jakub Jelen <jjelen@redhat.com>
+Reviewed-by: Pavol Žáčik <pzacik@redhat.com>
+(cherry picked from commit 92b6fb9c5e2d1606e8f809fd884ab6dd4d3b7d45)
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://git.libssh.org/projects/libssh.git/patch/?id=53b8152623290c69657a6774d96888b876e6061f
+---
+ src/socket.c | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/socket.c b/src/socket.c
+index 99dcf8c..ba9ba52 100644
+--- a/src/socket.c
++++ b/src/socket.c
+@@ -964,6 +964,7 @@ ssh_execute_command(const char *command, socket_t in, socket_t out)
+ int
+ ssh_socket_connect_proxycommand(ssh_socket s, const char *command)
+ {
++    char err_msg[SSH_ERRNO_MSG_MAX] = {0};
+     socket_t pair[2];
+     ssh_poll_handle h = NULL;
+     int pid;
+@@ -982,7 +983,17 @@ ssh_socket_connect_proxycommand(ssh_socket s, const char *command)
+     pid = fork();
+     if (pid == 0) {
+         ssh_execute_command(command, pair[0], pair[0]);
+-        /* Does not return */
++        /* child: Does not return */
++    }
++    /* parent */
++    if (pid == -1) {
++        close(pair[0]);
++        close(pair[1]);
++        ssh_set_error(s->session,
++                      SSH_FATAL,
++                      "fork failed: %s",
++                      ssh_strerror(errno, err_msg, SSH_ERRNO_MSG_MAX));
++        return SSH_ERROR;
+     }
+     s->proxy_pid = pid;
+     close(pair[0]);
+-- 
+2.45.4
+
@@ -0,0 +1,37 @@
+From e8547607304c02bdd7191e8f3640b0eb99fa340f Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 28 Jul 2026 06:50:36 +0000
+Subject: [PATCH] CVE-2026-59847 libcrypto: Fix tag verification of AES-GCM
+ ciphers
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://git.libssh.org/projects/libssh.git/patch/?id=c483a187354dfd96b16d3309a74f6d1cf82c2074
+---
+ src/libcrypto.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/libcrypto.c b/src/libcrypto.c
+index aa48c67..c610f37 100644
+--- a/src/libcrypto.c
++++ b/src/libcrypto.c
+@@ -585,7 +585,7 @@ evp_cipher_aead_encrypt(struct ssh_cipher_struct *cipher,
+     rc = EVP_EncryptFinal(cipher->ctx,
+                           NULL,
+                           &tmplen);
+-    if (rc < 0) {
++    if (rc != 1 || outlen != 0) {
+         SSH_LOG(SSH_LOG_WARNING, "EVP_EncryptFinal failed: Failed to create a tag");
+         return;
+     }
+@@ -673,7 +673,7 @@ evp_cipher_aead_decrypt(struct ssh_cipher_struct *cipher,
+     rc = EVP_DecryptFinal(cipher->ctx,
+                           NULL,
+                           &outlen);
+-    if (rc < 0) {
++    if (rc != 1 || outlen != 0) {
+         SSH_LOG(SSH_LOG_WARNING, "EVP_DecryptFinal failed: Failed authentication");
+         return SSH_ERROR;
+     }
+-- 
+2.45.4
+