Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

CVE-2026-35385: dropbear scp, OpenWrt 24.10.7 to 24.10.8

OpenWrt 24.10.8 takes six fixes of Dropbear 2026.90 (OpenWrt commit 262c093). Four are in scp, which OpenWrt builds into the same binary as the server:

  • CVE-2026-35385: scp kept the setuid and setgid bits of the files it received, so a server could plant a setuid program. The fix, from OpenSSH, clears them.
  • The rest of the CVE-2019-6111 fix: names a server sends must match the pattern asked for, with braces expanded.
  • -r into a directory that exists is refused.

The other two are in the server: an authenticated user could bypass the command= option of authorized_keys where the server runs with -t, and authorized_keys is now opened without blocking. Neither has a CVE.

OpenWrt runs sstrip on what it ships, so only the segments of the file are left. On MIPS, Dropbear is MIPS32.

Get the binaries

$ for v in 24.10.7 24.10.8; do
    mkdir -p $v
    curl -s https://downloads.openwrt.org/releases/$v/targets/armsr/armv8/openwrt-$v-armsr-armv8-rootfs.cpio.gz \
      | gunzip | (cd $v && cpio -id usr/sbin/dropbear)
  done

Compare

$ hereticus --format markdown 24.10.7/usr/sbin/dropbear 24.10.8/usr/sbin/dropbear
FUNCTIONCHANGESCORE+/-/~TOUCHEDMATCHED BY
sub_1650c -> sub_1623cchanged0.69369/64/1463 branch, 40 call, 1 callee, 31 jump, 63 mem, 4 textsimilar
sub_1a5cc -> sub_1a83cchanged0.9475/58/1912 branch, 16 call, 1 callee, 6 jump, 43 mem, 2 constsimilar
sub_3d08 -> sub_3d88changed0.9921/4/42 branch, 2 call, 1 jump, 9 mem, 2 const, 1 textsimilar
sub_105a4 -> sub_10128changed0.996/9/02 mem, 1 constsimilar
sub_13ec8 -> sub_13530changed0.805/1/02 call, 2 memsimilar
sub_12144 -> sub_11b90changed0.944/5/11 call, 4 memsimilar
sub_13dfc -> sub_134a8changed0.463/22/32 branch, 1 call, 2 jump, 11 memsame callers
sub_11bec -> sub_13594changed0.973/4/21 memsimilar
sub_17dc0 -> sub_18028changed0.983/0/01 branch, 1 memsimilar
sub_1d2a8 -> sub_1d83cchanged0.993/3/32 constsimilar
sub_23f3c -> sub_245c8changed1.003/3/12 memsimilar
sub_1cea8 -> sub_1d440changed1.003/4/32 constsimilar
sub_1cbb0 -> sub_1cb48changed0.961/0/0-similar
sub_10c70 -> sub_107e8changed0.971/2/02 memsimilar
sub_22ad4 -> sub_23160changed0.991/1/1-similar
sub_8200 -> sub_82d0changed0.780/0/1-similar
sub_1d8e4 -> sub_1de78changed0.980/0/1-similar
sub_c40c -> sub_c4dcchanged values1.00-1 textidentical shape
  • sub_10bc8: new

419 matched (399 unchanged, 20 changed), 0 gone, 1 new

The texts each function points at name the first rows:

RowFunctionTexts
sub_1650csink of scp"mtime.sec not delimited", and new "filename does not match request"
sub_1a5ccthe authentication of the server"unknown service in auth"
sub_3d08the options of the server"Bad maxauthtries '%s'"
sub_105a4the progress meter of scp" %3d%% "

The fix is on row 1: GCC inlined the new pattern matching and brace expansion into sink, which took 369 instructions.

Read the fix

$ hereticus --view il --diff sub_1650c 24.10.7/usr/sbin/dropbear 24.10.8/usr/sbin/dropbear
...
  x21 = load.64 [@umask]
...
  call exit
+ w0 = w0 | 0xe00
+ store.32 [sp + 0x90] = w0
+ call x21
...

x21 holds the address of umask. 0xe00 is 07000, the setuid, setgid and sticky bits: sink now adds them to the mask of the process, so no file it creates keeps them.

The other architectures

BuildRowsRow of the fix
armsr/armv8, AArch64191
armsr/armv7, A32211
malta/be, MIPS32 big endian161
malta/le, MIPS32 little endian281

In 24.10.8 the linker gave some static objects a slot of the global offset table of their own, where 24.10.7 loaded the slot of the page and added the low half. That added half no longer reads as an edit (RESEARCH.md, “Two ways MIPS loads an address”); before, it put 18 more rows in the report for MIPS32 little endian, and the fix on row 2.

hereticus-cli/tests/truth_cves.rs locks these ranks, and fixtures/cve_binaries.py fetches and pins the binaries.