search

coreos / fedora-coreos-tracker

Issue tracker for Fedora CoreOS
https://fedoraproject.org/coreos/
262 stars 59 forks source link

CVE-2024-6387: OpenSSH 9.8: regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems #1754

Closed travier closed 2 months ago

travier commented 2 months ago

See:

We discovered a vulnerability (a signal handler race condition) in OpenSSH's server (sshd): if a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously, but this signal handler calls various functions that are not async-signal-safe (for example, syslog()). This race condition affects sshd in its default configuration.

They only have working exploits for i686 right now.

The configuration workarounds are not ideal unfortunately: https://lwn.net/ml/all/4f270df5-2b24-979d-c03f-6d8f3b9d007d@mindrot.org/

travier commented 2 months ago

Technically it's pending a package update in Fedora.

cverna commented 2 months ago

Update with the backported fix for F40 https://bodhi.fedoraproject.org/updates/FEDORA-2024-dc89a2e1bf

travier commented 2 months ago

I did https://github.com/coreos/fedora-coreos-config/actions/runs/9757857281 to fast-track it and it gets me:

Exception: Package openssh-9.6p1-1.fc40.4 doesn't match expected dist tag .fc40
travier commented 2 months ago

Did a manual fasttrack: https://github.com/coreos/fedora-coreos-config/pull/3047

travier commented 2 months ago

Alternative mitigation in https://social.treehouse.systems/@marcan/112715795823895634:

echo 'OPTIONS=-e' | sudo tee -a /etc/sysconfig/sshd && sudo systemctl restart sshd
jlebon commented 2 months ago

This was fixed in testing 40.20240701.2.0 and next 40.20240701.1.0. Currently, we are not planning an ad-hoc release for stable; it'll ship in stable next week.

marmijo commented 1 month ago

The fix for this went into stable stream release 40.20240701.3.0.