CVE-2025-11624: Wolfssh Sftp Handle Size Missing Exact Check
SFTP handle-size guard validates the client-supplied length against WOLFSSH_MAX_HANDLE (and the remaining packet space) but does not require it to equal sizeof(WFD) / sizeof(HANDLE). The following WMEMCPY into the fixed-size stack-allocated file-descriptor variable can then overflow up to (WOLFSSH_MAX_HANDLE - sizeof(fd)) bytes of stack memory (CWE-787). Add
greprules fetch cve-2025-11624-wolfssh-sftp-handle-size-missing-exact-check --engine opengrepDescription
SFTP handle-size guard validates the client-supplied length against WOLFSSH_MAX_HANDLE (and the remaining packet space) but does not require it to equal sizeof(WFD) / sizeof(HANDLE). The following WMEMCPY into the fixed-size stack-allocated file-descriptor variable can then overflow up to (WOLFSSH_MAX_HANDLE - sizeof(fd)) bytes of stack memory (CWE-787). Add
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.