CVE-2025-5372

What it actually does

The flaw causes ssh_kdf() to incorrectly report success on key derivation failure due to mismatched return value conventions between OpenSSL and libssh, resulting in use of uninitialized key material in SSH sessions.

Why it matters to the business

Potential compromise of SSH session security allowing attackers to decrypt, tamper with or disrupt encrypted communications in affected systems; widespread use of libssh in infrastructure increases exposure across many environments.

How an attack unfolds

An attacker initiates an SSH connection to a vulnerable server; during key exchange the flawed KDF leads to weak or uninitialized keys being used enabling the attacker to exploit the resulting cryptographic weaknesses.

How to fix it

Update libssh to commit dff6c0821ed54f6fbf5b755af43f54cbb723b1b1 or later; upgrade affected Chainguard packages (metallb-fips, metallb-controller-fips, metallb-frr-compat-fips, metallb-frr-fips, metallb-speaker-fips) to version 0.15.2-r1 or later.

How to confirm the fix worked

Verify installed libssh version or package versions against the listed fixed releases; perform functional SSH connection tests confirming proper key derivation without uninitialized buffers.

Typical attack path

1. Establish SSH connection to target
2. Trigger key derivation in ssh_kdf()
3. Exploit resulting use of uninitialized keys to compromise session confidentiality integrity or availability

How to detect it

Review SSH daemon and application logs for key exchange errors or anomalies around key derivation; inspect for any unexpected session terminations or cryptographic failures post-connection.

What your security team should do

• Apply the listed fixed versions immediately given the cryptographic nature of the flaw
• Inventory all systems using libssh built against OpenSSL versions older than 3.0
• Monitor SSH traffic for anomalies after patching