{"id":117137,"date":"2024-07-09T15:43:01","date_gmt":"2024-07-09T13:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda"},"modified":"2024-07-09T15:43:01","modified_gmt":"2024-07-09T13:43:01","slug":"uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-paketah-s-openssh-iz-sostava-rhel-9-dopuskayushhaya-udalyonnoe-vypolnenie-koda","title":{"rendered":"A vulnerability in the OpenSSH packages in RHEL 9 allows for remote code execution.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
During the investigation of the critical vulnerability discovered in OpenSSH last week, a similar vulnerability (CVE-2024-6409) has been found, allowing remote code execution without authentication. The new vulnerability is not as severe as the previous one, as it manifests after privilege escalation in a child process spawned by the SSH server. This vulnerability exists in Red Hat Enterprise Linux 9 packages for openssh, based on the OpenSSH 8.7 release published in 2021. The issue also affects packages for Fedora Linux 36 and 37, based on OpenSSH releases 8.7 and 8.8. <\/p>\n
Essentially, the vulnerability is similar to the previous issue and is also caused by a race condition in the SIGALRM interrupt handler, arising from the execution of functions not designed to be called in an asynchronous mode from signal handlers. The handler triggers upon a timeout defined by the LoginGraceTime parameter and interrupts the current code execution. Using functions in the interrupt handler that are not designed for asynchronous execution, particularly those involving dynamic memory allocation like syslog(), can lead to corruption of malloc's internal structures when SIGALRM is triggered during specific code execution. <\/p>\n
The new vulnerability differs in that the race condition arises due to the invocation of the cleanup_exit() function in the grace_alarm_handler() signal handler. In the main OpenSSH codebase, this function may be used in asynchronously executed code, but in the RHEL 9 and Fedora packages, an additional patch was applied that adds a call in cleanup_exit() for generating audit events, meant for use in signal handlers. <\/p>\n
This patch was used in RHEL 9 and derivatives in packages based on OpenSSH 8.7p1. In the latest Fedora releases, the issue does not occur, as Fedora 38 and later have switched to a newer version of OpenSSH without altering cleanup_exit(). Unlike the previous vulnerability, a workaround for the new issue based on using the -e option in sshd, which disables logging through syslog, is not effective. However, to mitigate the vulnerability in sshd_config, the parameter 'LoginGraceTime=0' can be set. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"