CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems
2 years ago by 0x0 to c/security
Regression in signal handler.
This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions (for example, malloc() and free()): an unauthenticated remote code execution as root, because it affects sshd's privileged code, which is not sandboxed and runs with full privileges.
You can read them as separate statements with the middle repeated and a logical AND between them:
If (8.5p1 <= your OpenSSH version) AND (your OpenSSH version < 9.8p1) Then you are vulnerable
It’s the same as saying if your OpenSSH version is between these two versions (including 8.5p1, but not 9.8p1), then you are vulnerable
Because this is a regression and this particular issue was introduced in 8.5p1. So it only affects versions newer than that, up until when it was fixed in 9.8p1.
For an integer, 4 < x < 6 x has to be 5. It's the only value that satisfies all sides of the equation.
You are deriving a set of values for open ssh that satisfies all sides of the equation.
I think it's more of a mathematical representation than programming representation (I mean, I don't know of a language that would accept that syntax).
Certainly psuedocode would have quick statements like this
@programming.dev
A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.
Rules :
Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient
go to feed...
@programming.dev
A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.
Rules :
Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient
go to feed...
save