There’s a vulnerability in the libssh package where an unexpectedly large input buffer passed to the ssh_get_fingerprint_hash() function can lead to an integer overflow in the bin_to_base64() function. This results in memory under allocation, potentially causing out of bounds writes and heap corruption. This issue specifically affects 32-bit builds of libssh.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.5 | CVE-2025-4877 |
Exploitation
To exploit this vulnerability, an attacker with local access can craft a specially formatted input buffer that exceeds the expected size when passed to the ssh_get_fingerprint_hash() function. This can trigger the integer overflow in the bin_to_base64() function, leading to heap corruption and potentially allowing the attacker to execute arbitrary code.
Affected Products
- libssh: Affected in 32-bit builds, where the vulnerability can be exploited through the ssh_get_fingerprint_hash() function.
Mitigation
To mitigate this vulnerability, it is recommended to update the libssh package to the latest version that addresses this issue. Additionally, restricting local access to systems running vulnerable versions can help reduce the risk of exploitation.