===========================================================
== Subject:     Likely read beyond bounds in sftp server message decoding
==
== CVE ID#:     CVE-2025-5449
==
== Versions:    libssh 0.11.0 and 0.11.1
==
== Summary:     Incorrect packet length check in
==              sftp_decode_channel_data_to_packet() which
==              is used in the sftpserver implementation.
==
===========================================================

===========
Description
===========

Malicious clients can send invalid SFTP packets with payload size field set to
value 0x7ffffffc (2GB - 3B). This value incorrectly passes the validity check
on 32b platforms in the function sftp_decode_channel_data_to_packet().

This is caused by integer overflow in the packet length check. But the wrong
buffer bounds are not used for accessing beyond the buffer bounds as the
following call to `ssh_buffer_add_data()` will already fail to allocate buffer
of size > 256MB, leading to the self-DoS of the sftp server process.

This is exploitable for sftp servers running on on 32b platforms only.

==================
Patch Availability
==================

Patches addressing the issues have been posted to:
https://www.libssh.org/security/
Additionally, libssh 0.11.2 have been issued
as security releases to correct the defect.  SSH administrators are
advised to upgrade to these releases or apply the patch as soon
as possible.

==================
CVSSv3 calculation
==================
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C (3.8)

==========
Workaround
==========
None

=======
Credits
=======

Originally reported by Ronald Crane (Hackerone: tdp3kel9g) via Zippenhop LLC
Patches provided by Jakub Jelen from the libssh team.

==========================================================
== The libssh team
==========================================================