Cloudanix VulnDB

CVE-2025-5351

Medium · 6.5

CVSS

6.5

EPSS

0.6%

Published

Jul 4, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in a widely used encryption library can make programs that handle secure keys crash under certain conditions, potentially interrupting secure connections until the software is updated.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Double-free of a memory structure in libssh key export error handling path can cause heap corruption or process instability under low-memory conditions during cryptographic key serialization.

Why it matters to the business

Applications performing SSH key export operations may crash or become unstable, disrupting secure connectivity and management workflows in environments relying on libssh; low exploit maturity and absence from KEV reduce immediate urgency but the flaw still affects reliability across dependent packages.

How an attack unfolds

An attacker with limited privileges triggers repeated error conditions during key export (such as memory pressure) to induce the double-free, resulting in heap corruption that manifests as application instability or denial of service; no public exploitation or named threat actors observed.

How to fix it

Upgrade libssh to commit dff6c0821ed54f6fbf5b755af43f54cbb723b1b1 or newer; for Chainguard packages update newrelic-k8s-metadata-injection-fips and newrelic-k8s-metadata-injection-fips-compat to 1.34.1-r1 or later. Disable key export operations where feasible until patched.

How to confirm the fix worked

Verify installed libssh version against fixed commit or package versions; run regression tests exercising key export under memory pressure; monitor process stability during key operations post-upgrade.

Typical attack path

  1. Obtain limited authenticated access to a service using libssh key export functionality
  2. Induce low-memory conditions or error paths during key serialization
  3. Trigger repeated failures in the export routine to hit the uncleared free path
  4. Cause heap corruption leading to process crash or instability

How to detect it

Monitor application and system logs for libssh process crashes or segmentation faults during key export operations; correlate with low-memory events; inspect core dumps for heap corruption patterns in affected libraries.

What your security team should do

  • Apply the listed fixed versions immediately on all affected systems
  • Prioritize patching internet-facing or multi-tenant services using libssh key export
  • Add version checks to dependency scanning pipelines
  • Review memory sanitizer results on key export code paths

The record

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libssh 0 No fix
Debian:12 libssh 0 No fix
Debian:13 libssh 0 No fix
Debian:14 libssh 0 0.11.2-1
openSUSE:Tumbleweed libssh 0 0.11.2-1.1

Related vulnerabilities