CVE-2025-5372: 
NixOS vulnerability analysis and mitigation

CVE-2025-5372 is a cryptographic bypass vulnerability in libssh caused by incorrect return code handling in the ssh_kdf() key derivation function. It affects all libssh versions prior to 0.11.2 that are built with OpenSSL versions older than 3.0. The flaw was reported to Red Hat's Bugzilla on May 30, 2025, and publicly disclosed on July 4, 2025. Affected downstream products include Red Hat Enterprise Linux 6–10, Red Hat OpenShift Container Platform 4.x, IBM CICS TX Standard, IBM Rapid Infrastructure Automation, and IBM Cloud Pak for Automation/Data System. The NVD CVSS v3.1 base score is 8.8 (High) (Red Hat Bugzilla, Red Hat Advisory).

The root cause is an incorrect calculation (CWE-682) arising from a semantic mismatch between OpenSSL and libssh return value conventions. OpenSSL's key derivation functions return 0 to signal failure, while libssh's internal convention treats 0 as SSH_OK (success). In the ssh_kdf() function, when OpenSSL fails to derive a key, libssh misinterprets the 0 return value as success and proceeds without initializing the output key buffers, leaving them containing uninitialized (garbage) memory. This condition is only triggered when libssh is compiled against OpenSSL versions older than 3.0, which changed the return value semantics. An authenticated attacker who can initiate an SSH session can trigger this code path, causing subsequent SSH communication to use uninitialized cryptographic key material (Red Hat Bugzilla, OSS-Sec).

Successful exploitation allows an authenticated attacker to cause SSH sessions to use uninitialized cryptographic key buffers, compromising the confidentiality, integrity, and availability of SSH communications. An attacker could potentially intercept and decrypt SSH session traffic, modify transmitted data in transit, or disrupt SSH communications entirely. The vulnerability affects any system or application using a vulnerable libssh build (pre-0.11.2 with OpenSSL < 3.0), including enterprise Linux distributions, container platforms, and IBM enterprise products (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires the attacker to be authenticated (low privileges required) and the target system to be running libssh built with OpenSSL < 3.0, limiting the attack surface. The EPSS score is approximately 0.037% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Bugzilla, OSS-Sec).

The primary remediation is to update libssh to version 0.11.2 or later, which correctly handles OpenSSL return values in ssh_kdf(). Alternatively, ensuring the underlying OpenSSL library is updated to version 3.0 or later eliminates the vulnerable code path, as the return value semantics differ in OpenSSL 3.x. Vendor-specific patches are available: Red Hat Enterprise Linux 8 via RHSA-2025:21977 (libssh-0.9.6-16.el8_10), RHEL 9.0 via RHSA-2025:23024, RHEL 8.8 via RHSA-2026:20610, and RHEL 8.4 via RHSA-2026:24349. Oracle addressed the issue in its January 2026 and April 2026 Critical Patch Updates. IBM issued fixes for CICS TX Standard, Rapid Infrastructure Automation, and Cloud Pak for Business Automation in April–May 2026. As a temporary workaround, restrict SSH access to trusted networks and authenticated users while patches are being deployed (Red Hat Advisory, Oracle CPU Jan 2026, IBM CICS TX).

Red Hat rated the vulnerability as "Moderate" severity and issued multiple errata across RHEL 6–10 and OpenShift. Ubuntu issued security notice USN-7619-1 for libssh. Slackware, openSUSE, Fedora, Debian (DLA-4385-1), AlmaLinux, Oracle Linux, and Alpine Linux all issued updated packages. Heise Online published a news article noting that IBM QRadar SIEM SSH sessions could be compromised due to this flaw. The vulnerability received broad coverage across Linux distribution security channels and vulnerability tracking services, though no significant social media controversy or researcher debate was observed (Red Hat Advisory, Ubuntu Notice, Heise Online).