Gentoo Linux — net-libs/libssh — multiple vulnerabilities (8 CVEs) — patch and remediation guide

📖 ~4 min read  •  Source: Gentoo GLSA GLSA-202312-16

Related CVEs: CVE-2023-6004 CVE-2023-48795 CVE-2021-3634 CVE-2023-1667 CVE-2023-2283 CVE-2020-16135 CVE-2019-14889 CVE-2020-1730

Upstream summary: Multiple vulnerabilities have been discovered in libssh. Please review the CVE identifiers referenced below for details.

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Nothing executes net-libs/libssh on its own; its code runs inside whatever links against or imports it, so the exposed surface on a Gentoo Linux host is the union of every process that has loaded it — web workers, cron jobs, mail handlers, backup agents. The package manager replaces the files on disk, but processes already running keep the old build mapped, and virtualenvs, vendored copies and container images each carry their own copy, so a host can report itself patched while still running vulnerable code. net-libs/libssh is a library — code loaded by other programs rather than a daemon — so there is no service to restart and rc-service net-libs/libssh will simply report no such service; restart its consumers instead.

Environment & Reproduction

Reproduction targets Gentoo Linux (rolling release; Portage). Confirm release, profile, and the installed package via Portage tooling:

cat /etc/gentoo-release
cat /etc/os-release
eselect profile show
equery list net-libs/libssh
equery files net-libs/libssh | head -40
eix net-libs/libssh 2>/dev/null || qlist -I net-libs/libssh

Exercise the workload that uses net-libs/libssh while collecting:

# Branch on init system: systemd vs OpenRC
if [ -d /run/systemd/system ]; then \
  sudo journalctl -u libssh -b --no-pager | tail -200; \
else \
  sudo tail -200 /var/log/rc.log; sudo rc-status --all; \
fi
sudo tail -200 /var/log/emerge.log
sudo tail -200 /var/log/messages 2>/dev/null || sudo journalctl -xe --no-pager | tail -200
# Hardened/SELinux profiles only:

Root Cause Analysis

Root cause is documented in Gentoo GLSA GLSA-202312-16. Gentoo maintainers shipped fixed ebuilds for net-libs/libssh; running an outdated build leaves the host exposed to the failure modes described in the advisory. Because Gentoo is source-based, the relevant change is a SLOT bump or a USE-flag-conditional patch — correlate Portage history with system logs:

sudo tail -200 /var/log/emerge.log
genlop -t net-libs/libssh 2>/dev/null | tail -40   # if app-portage/genlop is merged
equery changes net-libs/libssh 2>/dev/null | tail -40
equery uses net-libs/libssh                         # USE flags that affect the build
sudo glsa-check -l affected | head
cat /proc/sys/kernel/tainted              # non-zero = tainted kernel / out-of-tree modules

Quick Triage

Run these on Gentoo Linux to capture the current state of net-libs/libssh:

qlist -Iv net-libs/libssh                                   # installed version(s)
equery list net-libs/libssh                                 # all installed SLOTs
equery check net-libs/libssh 2>/dev/null || qcheck net-libs/libssh    # verify shipped files
sudo glsa-check -l affected
sudo glsa-check -p GLSA-202312-16            # preview this advisory fix
# Init system aware service / firewall checks:
if [ -d /run/systemd/system ]; then \
  systemctl --failed --no-pager; \
else \
  sudo rc-status --servicelist 2>&1 | grep -E 'crashed|stopped' || sudo rc-status --all; \
fi
sudo nft list ruleset 2>/dev/null | head -50 || sudo iptables -S 2>/dev/null | head -50
# Hardened/SELinux profile only:
# If libssh ships a service unit (unit name may differ from pkg name, e.g.
systemctl list-unit-files 2>/dev/null | grep -i libssh | head || \
  ls /etc/init.d/ | grep -i libssh | head

Step-by-Step Diagnosis

1. Enumerate failed services across either init system.

   if [ -d /run/systemd/system ]; then systemctl --failed --no-pager; \
   else sudo rc-status --servicelist | grep -E 'crashed|stopped'; fi

2. Tail logs for net-libs/libssh on the host’s init system.

   if [ -d /run/systemd/system ]; then \
     sudo journalctl -u libssh -f --no-pager; \
   else \
     sudo tail -F /var/log/libssh/*.log 2>/dev/null; sudo tail -F /var/log/messages; \
   fi

3. Inspect firewall posture (nftables / iptables).

   sudo nft list ruleset 2>/dev/null | head -80
   sudo iptables -S 2>/dev/null | head -80
   sudo ip6tables -S 2>/dev/null | head -40

4. On hardened/SELinux profiles, surface denials and author a local policy module.

   command -v ausearch >/dev/null || { echo 'no audit (default profile)'; exit 0; }

5. Verify net-libs/libssh integrity and re-merge if anything is altered.

   sudo equery check net-libs/libssh 2>/dev/null || sudo qcheck net-libs/libssh
   sudo emerge -1 net-libs/libssh                       # one-shot rebuild
   sudo revdep-rebuild -i -- -av net-libs/libssh        # rebuild reverse-deps if ABI shifted

6. Correlate findings with /var/log/emerge.log, genlop -t net-libs/libssh, and Gentoo GLSA GLSA-202312-16 to pin the change that introduced the regression.

Solution – Primary Fix

Apply the corrective Portage transaction referenced by Gentoo GLSA GLSA-202312-16, then reload affected services on whichever init system this host uses:

sudo emerge --sync                                 # or: sudo emaint --auto sync
sudo emerge -avuDN @world                          # deep, --newuse, --update
# Or fix just this advisory:
sudo glsa-check -p GLSA-202312-16             # preview what will change
sudo glsa-check -f GLSA-202312-16             # apply the GLSA fix
# Or target just the affected package (oneshot avoids world-set churn):
sudo emerge --update --oneshot net-libs/libssh
sudo emerge --depclean -a                          # drop now-orphaned deps
# Restart the affected service via the host's init system:
if [ -d /run/systemd/system ]; then \
  sudo systemctl daemon-reload; \
  systemctl list-unit-files | grep -i libssh | head; \
  sudo systemctl restart libssh; \
  systemctl is-active libssh 2>/dev/null; \
else \
  ls /etc/init.d/ | grep -i libssh | head; \
  sudo rc-service libssh restart; \
  sudo rc-status | grep -i libssh; \
fi
qlist -Iv net-libs/libssh                                    # confirm new version

For kernel advisories on sys-kernel/gentoo-sources, sys-kernel/gentoo-kernel, or sys-kernel/gentoo-kernel-bin, rebuild the kernel and reboot:

sudo emerge --update --oneshot sys-kernel/gentoo-kernel-bin   # binary path (no rebuild)
# OR rebuild a source-based kernel after eselect-pinning the new sources:
sudo eselect kernel list
sudo eselect kernel set 1
sudo emerge --config sys-kernel/gentoo-kernel       # rebuild + install image/initramfs
sudo emerge --ask sys-kernel/dracut sys-kernel/installkernel
sudo grub-mkconfig -o /boot/grub/grub.cfg           # if using GRUB
sudo systemctl reboot 2>/dev/null || sudo shutdown -r now

Solution – Alternative Approaches

If the primary patch is not viable, choose from these:

• Toggle USE flags rather than upgrading (when the GLSA recommends disabling a vulnerable feature):

  equery uses net-libs/libssh
  sudo euse -E <flag>                              # gentoolkit: enable globally
  sudo euse -D <flag>                              # gentoolkit: disable globally
  # Or per-package in /etc/portage/package.use/libssh:
  echo 'net-libs/libssh -<flag>' | sudo tee -a /etc/portage/package.use/libssh
  sudo emerge -avuDN @world

• Roll back to a known-good ebuild version via package.mask and binhost cache:

  sudo tee -a /etc/portage/package.mask <<<'>=net-libs/libssh-<bad-ver>'
  sudo emerge --oneshot --update net-libs/libssh
  # Or pull a binary from your binhost (PORTAGE_BINHOST):
  sudo emerge --getbinpkgonly net-libs/libssh

• Unmask a higher-version fix from ~arch (testing) when stable is lagging:

  sudo tee -a /etc/portage/package.accept_keywords <<<'net-libs/libssh ~amd64'
  sudo emerge --update --oneshot net-libs/libssh

• On hardened / SELinux profiles, switch to permissive briefly to confirm policy is the cause, then re-enforce:

  # reproduce, capture denials, author a custom module:

• Take an LVM snapshot before a world upgrade for fast rollback:

  sudo lvs
  sudo lvcreate -s -n preupgrade -L 4G /dev/<vg>/<lv>
  # revert later via:
  sudo lvconvert --merge /dev/<vg>/preupgrade && sudo reboot

• Stage the upgrade on a non-prod chroot or use a binhost (binary package host) so production hosts pull a pre-built fixed ebuild:

  # On the build host:
  sudo emerge --buildpkg --oneshot net-libs/libssh
  # /etc/portage/make.conf on the build host:
  #   FEATURES="buildpkg"
  #   PKGDIR="/srv/binpkgs"
  # On consumer hosts, set PORTAGE_BINHOST and pull:
  sudo emerge --getbinpkgonly --update net-libs/libssh

Verification & Acceptance Criteria

All of these should pass after the fix:

qlist -Iv net-libs/libssh                                            # expected fixed version
sudo glsa-check -l affected                                # this GLSA no longer listed
sudo glsa-check -t all                                     # test ALL outstanding GLSAs
if [ -d /run/systemd/system ]; then \
  systemctl is-active libssh 2>/dev/null; \
  sudo journalctl -u libssh --since "5 minutes ago" --no-pager | grep -iE "error|fail" || echo OK; \
else \
  sudo rc-status | grep -i libssh; \
fi
sudo nft list ruleset 2>/dev/null | head -20 || sudo iptables -S | head -20
sudo emerge --info | head -20                              # profile + USE flags snapshot

The conditions described in the advisory must no longer be reported for net-libs/libssh across two consecutive runs.

Rollback Plan

Capture state before any change:

qlist -Iv > /root/portage-pre.txt
sudo cp -a /var/db/pkg /root/var-db-pkg-pre        # full package metadata snapshot
sudo cp -a /etc/portage /root/etc-portage-pre
# Optional LVM snapshot of the root LV:
sudo lvcreate -s -n preupgrade -L 4G /dev/<vg>/<lv>

To revert if the patch is bad:

# Pull the previous binpkg from your binhost (if FEATURES=buildpkg is enabled):
sudo emerge --getbinpkgonly --oneshot =net-libs/libssh-<older-ver>
# Or mask the bad version so emerge picks the older slot:
sudo tee -a /etc/portage/package.mask <<<'>=net-libs/libssh-<bad-ver>'
sudo emerge --oneshot net-libs/libssh
# Restart the service on whichever init system is in use:
if [ -d /run/systemd/system ]; then \
  sudo systemctl daemon-reload; \
  sudo systemctl restart libssh; \
else \
  sudo rc-service libssh restart; \
fi
# Or merge the LVM snapshot and reboot:
sudo lvconvert --merge /dev/<vg>/preupgrade && sudo reboot
# Custom SELinux policy cleanup (hardened profile only):

Prevention & Hardening

Reduce the chance of this recurring on Gentoo Linux:

• Automate GLSA + world checks (cron / systemd timer):

  sudo emerge -av app-portage/gentoolkit app-portage/eix
  # Cron example (daily 03:00):
  sudo tee /etc/cron.daily/gentoo-security <<'SH'
  #!/bin/sh
  set -e
  emaint --auto sync >/dev/null
  glsa-check -l affected | tee /var/log/glsa-affected.log
  SH
  sudo chmod +x /etc/cron.daily/gentoo-security

• Subscribe to security.gentoo.org/glsa and the Gentoo news feed for upstream advisories.

• Run a local binhost for controlled rollouts across a Gentoo fleet (one build host, many consumers):

  # On the build host /etc/portage/make.conf:
  FEATURES="${FEATURES} buildpkg"
  PKGDIR="/srv/binpkgs"
  # Then publish /srv/binpkgs over HTTPS and set on consumers:
  PORTAGE_BINHOST="https://binhost.example.com/binpkgs/"
  FEATURES="${FEATURES} getbinpkg"

• Mask sensitive packages so they cannot be auto-upgraded without review:

  sudo tee -a /etc/portage/package.mask <<<'>net-libs/libssh-<pinned-ver>'
  sudo tee -a /etc/portage/package.accept_keywords <<<'net-libs/libssh ~amd64'

• Monitor file integrity with AIDE:

  sudo emerge -av app-forensics/aide
  sudo aide --init && sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
  sudo aide --check

• Consider the hardened profile (or hardened/selinux) where threat model warrants it:

  sudo eselect profile list | grep -i hardened
  sudo eselect profile set <hardened-profile-number>
  sudo emerge -avuDN @world                          # rebuild world against new profile

• Keep revdep-rebuild clean after every world upgrade, and rebuild downstream consumers of upgraded libs.

• Apply CIS Linux Benchmark hardening (where applicable) and remove unused USE flags / packages.

Related Errors & Cross-Refs

Issues that commonly surface alongside a net-libs/libssh update: Portage lock contention, USE-flag dependency cycles (blockers), revdep ABI mismatches, OpenRC / systemd unit ordering issues, and kernel taint flags. Useful triage:

sudo emerge --info | head
sudo emerge -puDN @world | tail -40                # preview pending updates
sudo revdep-rebuild -i -- -p                       # show broken libraries
sudo eix-test-obsolete                             # repo / overlay drift
cat /proc/sys/kernel/tainted
sudo glsa-check -l affected

View all gentoo-linux tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Primary reference: Gentoo GLSA GLSA-202312-16. Manual pages useful on Gentoo Linux:

man emerge
man portage
man glsa-check
man equery
man eix
man rc-service
man rc-update
man systemctl
man journalctl
man dispatch-conf
man revdep-rebuild

Other resources: wiki.gentoo.org, Gentoo GLSA index, packages.gentoo.org, and per-package notes in /usr/share/doc/libssh/ for components implicated in this advisory.

View all Gentoo Linux tutorials on the Tutorials Hub →