The OpenSSH developers have continued to separate sshd into several individual executable files. In the first phase of this separation executed in May, functions related to session handling were moved from sshd to the separate process sshd-session, leaving only the functionality necessary for accepting a new network connection and launching sshd-session for each new session in sshd. Yesterday, a change was made to the OpenSSH codebase that added another process — sshd-auth, into which the code responsible for authentication was transferred from sshd-session.
The sshd-auth process is launched from sshd-session and allows further isolation of authentication-related data in the address space of a separate process, preventing access to this data in memory during attacks on the code used for handling connection stages prior to authentication completion. Additionally, this change slightly reduces memory consumption since the authentication-related code now resides in memory only during the authentication process and is then unloaded upon completion of the sshd-auth process.
Similar to sshd, ssh-session, and ssh-agent, random reallocation of the executable file has been applied to the sshd-auth process during each operating system boot. Random reallocation makes the function offsets in executable files and libraries poorly predictable, complicating the creation of exploits that use Return-Oriented Programming (ROP) techniques. Using ROP, an attacker does not attempt to place their code in memory, but instead operates with existing chunks of machine instructions that end with a return control instruction (typically the ends of functions). The exploit operates by creating a chain of calls to such blocks ('gadgets') to achieve the desired functionality.
Source: opennet.ru
