libssh: failed key derivation returns success, leaving SSH sessions keyed with uninitialized memory

Impact

OpenSSL returns 0 for failure while libssh treats 0 as success, so ssh_kdf() can report success when key derivation actually failed and the session then runs on uninitialized key buffers. Confidentiality and integrity of that SSH session are no longer what the protocol promises. This only affects libssh linked against OpenSSL older than 3.0, which in practice means RHEL 8 and its extended-support streams rather than current distributions. It matters on a fleet because libssh is what a lot of management tooling, orchestration agents and out-of-band automation link against for host-to-host SSH, not just interactive logins.

Who can reach it

Reachable by a party who can drive an SSH handshake against a libssh client or server, per the record's network vector with low privileges required. The record does not describe a reliable way to force the derivation failure, so treat the practical exploitability as unestablished.

What to do

Apply your distribution's libssh update - Red Hat has shipped errata for the affected RHEL 8 streams (RHSA-2025:21977 and later). Then restart every service that links libssh, since long-lived daemons keep the old library mapped; a package update alone does not fix a running process. Hosts already on OpenSSL 3.0 or newer are not affected by this code path.

References