Bug 2369705 (CVE-2025-5449)

Summary: CVE-2025-5449 libssh: Integer Overflow in libssh SFTP Server Packet Length Validation Leading to Denial of Service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adudiak, kshier, omaciel, security-response-team, stcannon, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2025-06-24   

Description OSIDB Bzimport 2025-06-02 07:13:03 UTC 
Integer Overflow vulnerability in the SFTP server implementation of libssh. The flaw exists in the sftp_decode_channel_data_to_packet() function, where a crafted packet with a large payload size (e.g., 0x7ffffffc) bypasses a validity check due to integer overflow on 32-bit platforms. While this does not lead to direct memory corruption, the failure to allocate the excessively large buffer results in a self-induced denial of service (DoS). This issue can only be exploited by authenticated users with SFTP access and affects servers running on 32-bit systems.

Affected versions: libssh 0.11.0 and 0.11.1