CVE-2025-5318: Libssh: out-of-bounds read in sftp_handle()
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftphandle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.
Other sources
Out-of-Bounds Read vulnerability in the SFTP server implementation of libssh, specifically within the sftphandle() function. The flaw is due to an incorrect boundary check that permits the function to access memory beyond the valid handle list. This leads to the return of an invalid pointer, which is subsequently used in further processing. Although the issue requires authenticated access to the server, it can be exploited by a remote attacker with valid credentials to potentially read unintended memory regions, which could expose sensitive information or affect service behavior.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libsshto a version that resolves this vulnerability.Fixed in 0.11.2 - Compensating control
Because exploitation requires authenticated access with valid credentials, restrict/limit SFTP/libssh server access to only necessary users and networks (e.g., via firewall/ACL) to reduce the likelihood of authenticated remote exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5318?
CVE-2025-5318 has been classified as a medium severity vulnerability due to the potential for out-of-bounds memory access.
How do I fix CVE-2025-5318?
To fix CVE-2025-5318, update the libssh library to the latest version that addresses this vulnerability.
What causes CVE-2025-5318?
CVE-2025-5318 is caused by an incorrect comparison check in the sftp_handle function of the libssh library.
Which software is affected by CVE-2025-5318?
CVE-2025-5318 affects the libssh library, specifically versions that have not been patched.
What are the potential impacts of CVE-2025-5318?
The potential impacts of CVE-2025-5318 include random crashes and possible exposure of sensitive data due to out-of-bounds reads.