CVE-2025-5372
📋 TL;DR
A vulnerability in libssh versions built with OpenSSL <3.0 causes the ssh_kdf() function to incorrectly report successful key derivation when it actually fails. This leads to uninitialized cryptographic keys being used in SSH sessions, potentially allowing attackers to compromise session confidentiality, integrity, and availability. Affected systems include those running vulnerable libssh versions compiled with older OpenSSL libraries.
💻 Affected Systems
- libssh
📦 What is this software?
Libssh by Libssh
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of SSH session security allowing man-in-the-middle attacks, session hijacking, and decryption of sensitive data transmitted over SSH.
Likely Case
Degraded cryptographic protection leading to potential information disclosure or session manipulation in targeted attacks.
If Mitigated
Limited impact due to network segmentation, proper key management, and monitoring of SSH sessions.
🎯 Exploit Status
Exploitation requires the attacker to be in a position to intercept or manipulate SSH traffic during vulnerable key derivation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisories for specific patched versions
Vendor Advisory: https://access.redhat.com/security/cve/CVE-2025-5372
Restart Required: Yes
Instructions:
1. Check if system uses libssh built with OpenSSL <3.0. 2. Apply vendor patches from Red Hat advisories RHSA-2025:21977 or RHSA-2025:23024. 3. Restart SSH services and applications using libssh. 4. Recompile libssh with OpenSSL 3.0+ if building from source.
🔧 Temporary Workarounds
Recompile with OpenSSL 3.0+
linuxRebuild libssh with OpenSSL version 3.0 or newer to avoid the vulnerable code path
# Rebuild libssh with OpenSSL 3.0+
# Example for source build:
./configure --with-openssl=/path/to/openssl-3.0+
make
make install
Use alternative SSH implementations
allTemporarily switch to OpenSSH or other SSH implementations not using vulnerable libssh
🧯 If You Can't Patch
- Implement network segmentation to isolate SSH traffic
- Enable enhanced monitoring and alerting for SSH session anomalies
🔍 How to Verify
Check if Vulnerable:
Check libssh version and linked OpenSSL version: ldd /path/to/libssh.so | grep libcrypto && strings /path/to/libssh.so | grep 'OpenSSL'Check Version:
rpm -q libssh || dpkg -l libssh* || find / -name '*libssh*' -type f | xargs ldd 2>/dev/null | grep -i opensslVerify Fix Applied:
Verify patched version is installed and linked to OpenSSL 3.0+: rpm -q libssh --changelog | grep CVE-2025-5372📡 Detection & Monitoring
Log Indicators:
- SSH connection failures with cryptographic errors
- Unusual SSH session termination patterns
- Failed key exchange attempts
Network Indicators:
- Abnormal SSH traffic patterns during key exchange
- SSH protocol anomalies in packet captures
SIEM Query:
source="ssh_logs" AND (error OR failure) AND (key OR crypto OR derivation)