CVE-2025-5318

What it actually does

Out-of-bounds read in sftp_handle due to incorrect bounds check on handle list, returning invalid pointer used in subsequent processing and allowing access to arbitrary memory.

Why it matters to the business

Organizations relying on libssh for SFTP or SSH services face risk of sensitive data exposure or degraded service behavior from authenticated remote users, increasing compliance and operational exposure.

How an attack unfolds

An authenticated remote attacker connects via SSH, initiates an SFTP session, and supplies a crafted handle that bypasses the faulty comparison, causing the library to dereference an out-of-bounds pointer and leak memory contents or alter execution flow.

How to fix it

Upgrade libssh to a version containing commit dff6c0821ed54f6fbf5b755af43f54cbb723b1b1 or later; for Mageia 6 cinnamon packages upgrade to 3.2.8-4.1.mga6 or newer. Recompile and redeploy any statically linked applications.

How to confirm the fix worked

Verify installed libssh version against fixed commit or package release; run regression tests exercising SFTP handle operations; confirm absence of the vulnerable comparison logic via source review or binary diff.

Typical attack path

1. Establish authenticated SSH session to target service
2. Open SFTP subsystem channel
3. Send SFTP request containing invalid or out-of-range file handle
4. Trigger sftp_handle processing path that performs incorrect bounds check
5. Read returned pointer contents to obtain memory disclosure or induce behavioral change

How to detect it

Review SSH daemon and application logs for unusual SFTP session activity or handle-related errors around the time of suspected access; correlate with memory-leak indicators in process dumps if available.

What your security team should do

• Immediately inventory all systems using libssh and schedule upgrades to the listed fixed versions
• Prioritize patching internet-facing or high-value SSH/SFTP endpoints first
• Monitor vendor advisories for downstream packages that embed libssh
• Apply compensating controls such as network segmentation until patches are deployed