CVE-2026-66034

Executive Summary

CVE-2026-66034 is a high-severity heap memory corruption vulnerability in libssh2 versions <= 1.11.1. The flaw resides in the libssh2_publickey_list_fetch() function’s handling of the SSH publickey subsystem response (version 1). A malicious SSH server can supply a crafted comment_len value that leads to an arbitrary-length heap out-of-bounds read, leaking adjacent heap pointers (defeating ASLR), followed by a free of an uninitialized pointer when the error path attempts to clean up a non-zeroed realloc() region. This can corrupt the heap allocator state and potentially enable arbitrary code execution on the client.

Since this is a client‑side library (typically embedded in SSH clients, file transfer tools, or automation scripts), exploitation requires the user or automated agent to connect to an attacker‑controlled SSH server that deliberately advertises the publickey subsystem with a malicious version‑1 handshake.

No proof‑of‑concept code or publicly available exploit has been observed at this time. The patch (commit a13bb6c) has not been backported to a stable release, leaving all installations using libssh2 ≤ 1.11.1 vulnerable.

CVSS Breakdown & Threat Level

The attack requires the victim to initiate an SSH connection to a malicious server, but no further privileges are needed. The impact is severe because an information leak (heap pointers) directly enables subsequent heap manipulation, potentially leading to full remote code execution on the client host.

Deep Dive & Mechanics

The vulnerability is triggered during the SSH publickey subsystem negotiation. The client requests a list of public keys via the publickey subsystem using version 1 of the protocol. The server sends a response containing a comment_len field that the client trusts without verifying that enough data remains in the receive buffer.

Out‑of‑Bounds Read:
In libssh2_publickey_list_fetch(), the parser advances a pointer by comment_len bytes without checking if the total response length is sufficient. This allows the server to specify a large value (e.g., > remaining buffer size), causing the pointer to read beyond the allocated buffer (heap out‑of‑bounds). Adjacent heap metadata and pointer data are leaked back to the attacker through the subsequent comment string.

Uninitialized Pointer Free:
The function also uses realloc() to allocate memory for storing the comment. If a previous allocation attempt failed or if the buffer was zero‑length, realloc() may return a non‑zeroed region containing stale pointers. When the error path is triggered (due to the bounds check failure), the code attempts to free() this uninitialized pointer. This corrupts the heap allocator’s free‑list and can lead to arbitrary write primitives.

The combination of an ASLR‑defeating information leak and a heap corruption primitive makes the vulnerability highly exploitable by a skilled adversary. The attack is fully server‑driven; the client only needs to connect and request public key listing.

Vulnerable vs. Patched Code

Vulnerable snippet (libssh2 <= 1.11.1, publickey.c):

/* Read comment_len */
if (buffer_read_u32(&ptr, &comment_len)) goto fail;
/* Missing bounds check: ptr is advanced by comment_len */
comment = ptr;
ptr += comment_len;

The patch in commit a13bb6c adds a proper length verification before advancing the pointer:

if (buffer_read_u32(&ptr, &comment_len)) goto fail;
if (comment_len > (unsigned long)(data_len - (ptr - data))) goto fail;
comment = ptr;
ptr += comment_len;

Additionally, the error‑cleanup path is hardened to initialise pointers to NULL after realloc() failures, preventing the free of uninitialised memory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Pre‑requisites:

• Attacker controls a server with a modified SSH daemon (e.g., OpenSSH with patched publickey handler).
• Victim runs a client that uses libssh2 (e.g., curl, SFTP tools, many automation frameworks).
• Victim initiates an SSH connection to the attacker’s server and triggers the public key listing (e.g., via ssh -o RequestTTY=no -o PreferredAuthentications=publickey user@attacker or by an SFTP client attempting authentication).

Attack Flow:

1. Set up a malicious SSH server that responds to the publickey subsystem request with a malformed version‑1 packet.
2. The packet contains a crafted comment_len (e.g., 0xFFFF) that exceeds the remaining buffer.
3. The libssh2 client reads the comment string out‑of‑bounds, leaking heap pointers in the response to the server.
4. The server can then choose a second payload that triggers free() on an uninitialized pointer, corrupting the heap.
5. With careful heap grooming, the attacker can achieve code execution in the client process.

No public exploit code is available. We do not provide a full working exploit due to ethical and legal constraints. Testing should only be performed in isolated lab environments.

Blue Team (Defensive Detection)

Detection Strategies:

• Monitor for abnormal SSH client behaviour: large comment_len values in server responses (though the client cannot observe this directly – detection must occur at network level or via client logs).
• Enable client‑side logging of SSH library errors: libssh2 may generate “ssh_packet_require” or “memory allocation” errors before crashing.
• Use memory protection features (ASLR, CFG, SafeSEH) to increase exploitation difficulty.
• Deploy network‑level Suricata rules (see Detection Engineering) to detect the anomalous response size.

Lab Setup:

1. Build a vulnerable libssh2 (git clone at tag libssh2-1.11.1).
2. Compile a small test client that calls libssh2_publickey_list_fetch().
3. Set up a Python or C malicious server using paramiko (custom packet builder) to send oversized comment_len.
4. Run the client against the malicious server; observe crash / memory leak (use Valgrind or AddressSanitizer).

Indicators of Compromise (IOCs)

• Network:

  • SSH packets with SSH2_MSG_CHANNEL_DATA containing a publickey version‑1 response where the comment_len field is ≥ 65535 or exceeds the total packet length.

• Host: (Client)

  • Heap shadow memory corruption (detected by CHKDSK / gdb core).
  • Unusual crash in libssh2_publickey_list_fetch / libssh2_session_free with memory access violation.
  • Log entries: libssh2: publickey: failed to parse version 1 response.
  • ASLR bypass – if attacker leaks pointer values, subsequent heap spray patterns may be visible in process memory dumps.

• Supply Chain (if applicable): This is not an NPM/PyPI/Go/Ruby package, but libssh2 is a C library used in many Linux distributions and embedded systems.

Detection Engineering

YARA Rule (for scanning binary images / core dumps)

rule libssh2_publickey_oob_read {
    meta:
        description = "Detects heap out-of-bounds read in libssh2_publickey_list_fetch (comment_len overflow)"
        author = "DevSecOps CTI"
        date = "2026-01-01"
        hash = "a13bb6c"
        score = 75
    strings:
        $code1 = { 0F B6 45 ?? 89 45 ?? 8B 45 ?? 03 45 ?? 89 45 ?? }  // vulnerable pointer advance pattern
        $code2 = { E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 83 F8 FF 75 ?? }  // after realloc call
        $str = "publickey"
    condition:
        all of them
}

Sigma Rule (Windows Event / Sysmon) – Client crash detection

title: libssh2 Heap Corruption from Publickey Subsystem
id: 8f3a5c2e-1b6d-4f97-9e2a-7b4a0c3d1e5f
status: experimental
description: Detects process crash with heap corruption likely due to CVE-2026-66034
logsource:
    product: windows
    service: sysmon/security
detection:
    selection:
        EventID: 1001 (Windows Error Reporting)
        - Keywords: "heap_corruption" OR "status_access_violation"
        - Module: "libssh2.dll"
    condition: selection
falsepositives:
    - Other heap bugs in libssh2
level: high

Suricata Rule (Network Detection – abnormal publickey response)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SSH publickey version-1 oversized comment_len";
    flow:to_client,established;
    content:"|00 00 00 05|"; offset:0; depth:4;   # SSH packet header (length placeholder)
    content:"|06|"; within:1;                       # SSH_MSG_CHANNEL_DATA
    content:"|00 00 00 0b|publickey"; within:20;    # subsystem name
    content:"|01|"; within:1; distance:0;           # version 1
    content:"|00 00|"; distance:0; within:2;         # comment_len (should be <= remaining)
    byte_test:2,>,256,0,relative;                    # trigger if comment_len > 256
    sid:1000001; rev:1;)

Note: Replace backslashes with forward slashes in the rule to satisfy the YARA/Suricata syntax requirements – already correct.

Remediation & Mitigation

Immediate Actions:

1. Apply the patch: Cherry-pick commit a13bb6c from the libssh2 repository into any affected build.
2. Update to a fixed version: Once a new release (e.g., 1.11.2 or higher) becomes available, upgrade immediately.
3. Restrict outbound SSH connections: Use network segmentation to prevent users from connecting to untrusted SSH servers.
4. Use memory hardening: Compile libssh2 with AddressSanitizer or enable Microsoft's /guard:cf (Control Flow Guard) to raise exploitation difficulty.
5. Monitor for anomalous heap behaviour with tools like mpatrol or valgrind during development.

Workarounds (if patching is not possible):

• Disable the publickey subsystem in the client configuration (e.g., PubkeyAuthentication no) – may affect functionality.
• Use alternative SSH libraries (e.g., libssh, Dropbear) for applications that do not require the publickey subsystem.

Long‑Term:

• Integrate automated fuzzing of SSH subsystem parsing into CI/CD pipelines.
• Implement a robust input‑length validation framework across all protocol parsers in libssh2.

Report generated by Valters IT DevSecOps CTI – CVE-2026-66034 analysis.