On: RegreSSHion: RCE in OpenSSH's server, on glibc-bas...

[Arnavion]

>As mentioned elsewhere here, is -D sufficient to avoid exploitation, or is -e necessary as well?

https://github.com/openssh/openssh-portable/blob/V_9_8_P1/ss...

sshd.c handles no_daemon (-D) and log_stderr (-e) independently. log_stderr is what is given to log_init in log.c that gates the call to syslog functions. There is a special case to set log_stderr to true if debug_flag (-d) is set, but nothing for no_daemon.

I can't test it right now though so I may be missing something.

[chasil → Arnavion]

I'm on Oracle Linux, and they appear to have already issued a patch for this problem:

  openssh-8.7p1-38.0.2.el9.x86_64.rpm
  openssh-server-8.7p1-38.0.2.el9.x86_64.rpm
  openssh-clients-8.7p1-38.0.2.el9.x86_64.rpm

The changelog addresses the CVE directly. It does not appear that adding the -e directive is necessary with this patch.

  $ rpm -q --changelog openssh-server | head -3
  * Wed Jun 26 2024 Alex Burmashev <alexander.burmashev@oracle.com> - 8.7p1-38.0.2
  - Restore dropped earlier ifdef condition for safe _exit(1) call in sshsigdie() [Orabug: 36783468]
    Resolves CVE-2024-6387

[INTPenis → Arnavion]

So in other words, -De is not a workaround. -Dde might be but it will cause more log output than is wanted.

[Arnavion → INTPenis]

-De is a workaround. -D is not.