3 ms·
For clarification, the bug is in a patch applied by red hat, not in openssh itself.
by hannob 2y ago
For clarification, the bug is in a patch applied by red hat, not in openssh itself.
- bonzini 2y agoTechnically the bug is in upstream code, but it is latent without the Red Hat patch: > cleanup_exit() was not meant to be called from a signal handler [...] Fedora 38+ has moved to newer upstream OpenSSH that doesn't have the problematic cleanup_exit() call. > This extra problematic logic only existed in upstream OpenSSH(-portable) for ~9 months The fix also doesn't touch the Red Hat-specific code: diff -urp openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c openssh-8.7p1-38.el9_4.1-tree/sshd.c --- openssh-8.7p1-38.el9_4.1-tree.orig/sshd.c 2024-07-08 03:42:51.431994307 +0200 +++ openssh-8.7p1-38.el9_4.1-tree/sshd.c 2024-07-08 03:48:13.860316451 +0200 @@ -384,7 +384,7 @@ grace_alarm_handler(int sig) /* Log error and exit. */ if (use_privsep && pmonitor != NULL && pmonitor->m_pid <= 0) - cleanup_exit(255); /* don't log in privsep child */ + _exit(1); /* don't log in privsep child */ else { sigdie("Timeout before authentication for %s port %d", ssh_remote_ipaddr(the_active_state), They suggest applying it even on non Red Hat distros.
- loeg 2y agoSort of. The upstream bug isn't thought to be exploitable alone.