libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a server responds to SSH_FXP_OPEN with SSH_FXP_STATUS containing FX_OK, the response data buffer is freed, and if a subsequent sftp_packet_require() call returns a specific error such as LIBSSH2_ERROR_CHANNEL_PACKET_EXCEEDED, the same pointer is freed a second time, enabling tcache dup conditions on glibc systems that allow overlapping allocations and function pointer overwrites.
Weakness
The product calls free() twice on the same memory address.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libssh2 | Libssh2 | * | 1.11.1 (including) |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | RedHat | libssh2-0:1.8.0-4.el7_9.2 | * |
| Red Hat Hardened Images | RedHat | libssh2-main-1.11.1-10.2.hum1 | * |
| Libssh2 | Ubuntu | esm-apps-legacy/xenial | * |
| Libssh2 | Ubuntu | esm-apps/bionic | * |
| Libssh2 | Ubuntu | esm-apps/focal | * |
| Libssh2 | Ubuntu | esm-apps/jammy | * |
| Libssh2 | Ubuntu | esm-infra-legacy/trusty | * |
| Libssh2 | Ubuntu | jammy | * |
| Libssh2 | Ubuntu | noble | * |
| Libssh2 | Ubuntu | resolute | * |
| Libssh2 | Ubuntu | upstream | * |