From 8e4d67aa9eda455bfad9ac610e54b7a548d0aa08 Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Wed, 6 Aug 2025 11:10:38 +0200 Subject: [PATCH 2/3] CVE-2025-8277: ecdh: Free previously allocated pubkeys Signed-off-by: Jakub Jelen Reviewed-by: Andreas Schneider (cherry picked from commit c9d95ab0c7a52b231bcec09afbea71944ed0d852) CVE: CVE-2025-8277 Upstream-Status: Backport [https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=8e4d67aa9eda455bfad9ac610e54b7a548d0aa08] Signed-off-by: Rajeshkumar Ramasamy --- src/ecdh_crypto.c | 1 + src/ecdh_gcrypt.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/ecdh_crypto.c b/src/ecdh_crypto.c index a3c78469..bb4c3fc0 100644 --- a/src/ecdh_crypto.c +++ b/src/ecdh_crypto.c @@ -106,6 +106,7 @@ int ssh_client_ecdh_init(ssh_session session){ } session->next_crypto->ecdh_privkey = key; + ssh_string_free(session->next_crypto->ecdh_client_pubkey); session->next_crypto->ecdh_client_pubkey = client_pubkey; rc = ssh_packet_send(session); diff --git a/src/ecdh_gcrypt.c b/src/ecdh_gcrypt.c index b2e5390c..e998a582 100644 --- a/src/ecdh_gcrypt.c +++ b/src/ecdh_gcrypt.c @@ -106,9 +106,10 @@ int ssh_client_ecdh_init(ssh_session session) gcry_sexp_release(session->next_crypto->ecdh_privkey); session->next_crypto->ecdh_privkey = NULL; } - session->next_crypto->ecdh_privkey = key; key = NULL; + + SSH_STRING_FREE(session->next_crypto->ecdh_client_pubkey); session->next_crypto->ecdh_client_pubkey = client_pubkey; client_pubkey = NULL; -- 2.48.1