Re: CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems

[jvoisin <julien.voisin () dustri org>]

> This vulnerability is exploitable remotely on glibc-based Linux systems,
> where syslog() itself calls async-signal-unsafe functions (for example,
> malloc() and free()): an unauthenticated remote code execution as root,
> because it affects sshd's privileged code, which is not sandboxed and
> runs with full privileges. We have not investigated any other libc or
> operating system; but OpenBSD is notably not vulnerable, because its
> SIGALRM handler calls syslog_r(), an async-signal-safer version of
> syslog() that was invented by OpenBSD in 2001.

I gave a cursory look at the musl libc (https://musl.libc.org/) with the
help of the lovely #musl people, and it doesn't seem to be affected:

- Its syslog implementation (
https://git.musl-libc.org/cgit/musl/tree/src/misc/syslog.c ) doesn't
seem to (sub)call async-signal-unsafe functions.
- Thanks to its small size, it's not affected by ALSRn't.

So the worse that can happen might be a deadlock. Which is good news,
since the FILE-based exploitation technique looks easier on musl than on
glibc.

Moreover, as said by the project
(https://fosstodon.org/@musl/112711796005712271):

```
OpenSSH sshd on musl-based systems is not vulnerable to RCE via
CVE-2024-6387 (regreSSHion).

This is because we do not use localtime in log timestamps and do not use
dynamic allocation (because it could fail under memory pressure) for
printf formatting.

While the sshd bug is UB (AS-unsafe syslog call from signal context),
very deliberate decisions we made for other good reasons reduced the
potential impact to deadlock taking a lock.
```