Live data from Hacker News

OpenSSH Race condition resulting in potential remote code execution

openssh.com

11–20 of 29 posts

Re: OpenSSH Race condition resulting in potential remote code execution

#11

Earlier quoted context omitted.

Using this exploit, connected non root users can gain root access. Multiple user machines are more or less a thing of the past. These days most common use case of ssh is logging in to a remote server you already own with root privileges. So most of the users are unaffected by this exploit.

> These days most common use case of ssh is logging in to a remote server you already own with root privileges I only see this in relatively small and "young" teams. In any bigger organization I've worked in, a new user is created for each person who uses the machine.

I have a script that looks at your github org/team and generates/updates users on-demand then lets you connect.

The script is pretty straightforward, see AuthorizedKeysCommand and https://github.com/{$user}.keys

Re: OpenSSH Race condition resulting in potential remote code execution

#12

>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html

Red Hat 8 (maintenance support until 2029) has openssh-8.0 which is too old to be affected. I suspect other LTS distro may have openssh older 8.5 too. So the number should be below 99%.

Re: OpenSSH Race condition resulting in potential remote code execution

#13

>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html

> Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR. Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept.

It's pretty bad, but not trivial to exploit, especially since most machines are 64-bit with a larger space for ASLR.

Re: OpenSSH Race condition resulting in potential remote code execution

#14

>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html

A surprising number of systems are apparently on an old enough version to be unaffected; ex. RHEL 6-8 aren't vulnerable.

Re: OpenSSH Race condition resulting in potential remote code execution

#17
> Only two remote holes in the default install, in a heck of a long time!

As someone who doesn't know this kind of stuff well, will this cause OpenBSD to have to update the statement above?

https://www.openbsd.org

EDIT:

TFA says:

> OpenBSD is not vulnerable.

Re: OpenSSH Race condition resulting in potential remote code execution

#18
post #17

> Only two remote holes in the default install, in a heck of a long time! As someone who doesn't know this kind of stuff well, will this cause OpenBSD to have to update the statement above? https://www.openbsd.org EDIT: TFA says: > OpenBSD is not vulnerable.

OpenBSD isn't vulnerable, from https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion....:

> We have not investigated any other libc or operating system; but OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001.

Re: OpenSSH Race condition resulting in potential remote code execution

#19
post #5
post #3

Sorry, duplicate of https://news.ycombinator.com/item?id=40843778

I do like the headline of this post better though...

I learned about the vulnerability by the FreeBSD advisory and searched for ssh on hacker news and didn't find the other post... just to find the other post on the front page... well.

Re: OpenSSH Race condition resulting in potential remote code execution

#20

>A critical vulnerability in sshd(8) was present in Portable OpenSSH versions between 8.5p1 and 9.7p1 (inclusive) that may allow arbitrary code execution with root privileges. FYI that's every version published after 2021-03-03 That's got to be 99% of all linux machines in the world with an ssh daemon running right? https://www.openssh.com/releasenotes.html

> That's got to be 99% of all linux machines in the world with an ssh daemon running right?

Since 2021? Nah. 90% of my estate is ubuntu 2018 or earlier.

Post reply on HN