Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child

openwall.com

Post reply on HN
Print view View original

1–10 of 82 posts

Re: CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child

#8

Post by bonzini »

hannob wrote: post #2

For clarification, the bug is in a patch applied by red hat, not in openssh itself.

Technically the bug is in upstream code, but it is latent without the Red Hat patch:

> cleanup_exit() was not meant to be called from a signal handler [...] Fedora 38+ has moved to newer upstream OpenSSH that doesn't have the problematic cleanup_exit() call.

> This extra problematic logic only existed in upstream OpenSSH(-portable) for ~9 months

The fix also doesn't touch the Red Hat-specific code:

     diff -urp openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c openssh-8.7p1-38.el9_4.1-tree/sshd.c
     --- openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c 2024-07-08 03:42:51.431994307 +0200
     +++ openssh-8.7p1-38.el9_4.1-tree/sshd.c 2024-07-08 03:48:13.860316451 +0200
     @@ -384,7 +384,7 @@ grace_alarm_handler(int sig)
      
       /* Log error and exit. */
       if (use_privsep && pmonitor != NULL && pmonitor->m_pid
They suggest applying it even on non Red Hat distros.

Re: CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child

#9

Post by klysm »

londons_explore wrote: post #4

Couldn't this entire class of bug be solved by annotating signal handlers in the source code and checking at compile time that anything called from a signal handler is async-signal-safe?

Sounds reasonable, but since the language layer has no knowledge of signal handlers or what that means, it would be a separation of concerns problem. I'm sure you could get clang to do it, but still a tricky thing to design around.

Ultimately it's an example of an invariant where it's clear that programmers can't be trusted to uphold it. In this case, the consequences can be very significant.

Re: CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child

#10

Post by 2OEH8eoCRo0 »

candiddevmike wrote: post #5

The risk you take when you use a distribution that modifies upstream. Debian has had similar issues in the past (maybe not CVEs, but certainly packager-created bugs).

It's risks all the way down. There are risks to not patching upstream as well.
Post reply on HN