OsrsNeedsF2P 79 points in 3 days
They have named this vulnerability "regreSSHion", since it represents the re-emergence of a bug that was previously patched in 2006
That's a great name
79
runeko
6 points
in 2 daysAgreed, but I had to disable autocorrect to type it on my phone.
6Distant_Foreground 2 points in 2 days
Playful and descriptive!
2
treadful
50 points
in 3 daysThe new vulnerability, assigned CVE-2024-6387, allows for unauthenticated remote code execution (RCE) with root privileges, posing a severe threat to affected systems.
Oh, fuck. Guess this is my day now.
50mumblerfish 35 points in 3 days
If I'm not mistaken, it seems like this is a timing attack and you need a lot of attack attempts to make it work. If you have like a fail2ban rule for ssh it should mitigate this attack to quite some degree, right? (Of course updating would still be the best).
35shasta 9 points in 2 days
While statistically unlikely, it would be possible to exploit the vulnerability on the first attempt
9That's true.
3namingthingsiseasy 20 points in 2 days
The full write-up can be found here and should be fairly readable for users of this forum.
Some quotes that I thought were interesting:
With a heap corruption as a primitive, two FILE structures malloc()ated in the heap, and 21 fixed bits in the glibc's addresses, we believe that this signal handler race condition is exploitable on amd64 (probably not in ~6-8 hours, but hopefully in less than a week). Only time will tell.
So 64-bit systems seem to be a bit more resistant to this it seems? But I can't be completely sure given how much I've read about this yet.
This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions (for example, malloc() and free()): an unauthenticated remote code execution as root, because it affects sshd's privileged code, which is not sandboxed and runs with full privileges. We have not investigated any other libc or operating system; but OpenBSD is notably not vulnerable, because its SIGALRM handler calls syslog_r(), an async-signal-safer version of syslog() that was invented by OpenBSD in 2001.
It seems that non glibc-based systems also could be vulnerable, but they have not yet tried to demonstrate it yet (or have tried and not been successful).
And OpenBSD wins again it seems.
20Killing_Spark 4 points in 2 days
Yeah they were experimenting with 64bit exploitation when this signal handler got some focus regarding a (likely related) deadlock so they rushed to disclose their findings to the project to minimise the possibility of having eyes on this vulnerability
4lurklurk 24 points in 2 days
the in depth technical details
TL;DR; sigalarm handler calls syslog which isn't safe to call from a signal handler context.
Their example exploit needed about 10k attempts to get a remote shell so it's not fast or quiet, but a neat find regardless
24bitfucker 5 points in 2 days
I can already imagine the log generated will be a hint. We usually automate those anyway as it is closer to (D)DoS too.
5schizo 31 points in 3 days
Looks like Debian and Ubuntu have shipped patches, but I'm not seeing them show up in the RHEL-derivatives just yet, but I'm sure that'll be soon(TM).
31
lung
23 points
in 3 daysIt's shit like this that makes me convinced that governments can easily hack into pretty much every system
23Mike1576218 7 points in 2 days
They probably can. jut every hack done has the possibility of spoiling the exploit. A good exploit can cost a million $. So if hacking you is worth more then say 100k to them, you're in trouble. Otherwise they will only target you with everyday surveilance.
7NotMyOldRedditName 11 points in 3 days
I mean, on TV every character seems to be able to hack any system in a few seconds.
They clearly must have done some research by watching some NSA hackers who can hack every system.
11asyncrosaurus 6 points in 3 days
Most can't, but that's why clandestine cyber-intelligence firms like NSO group exist.
6-
lung
6 points
in 2 days
That's a spooky one. From first glance - 500 employees and zero click takeovers of phones? Yikes. Makes me want to not have a phone... Ofc Google/Apple/USA have had this capacity for ages
6 unexposedhazard 5 points in 2 days
Well only if they know about it before it gets patched...
5scrion 8 points in 2 days
That's why there is a huge market for 0-day exploits.
8teawrecks 4 points in 2 days
The NSA is doubtless sitting on a trove of these types of vulnerabilities to use when they really need access to something.
4IntentionallyAnon 16 points in 3 days
Good thing Iβm on vacation for the next week and have my PC turned off. Remind me to update on Saturday
16Mio 6 points in 2 days
Limit source ip access in the Firewall is my way to avoid this.
6veniasilente 11 points in 2 days
The fun thing about regressions: these things affects you if your system is new enough that it has the behaviour reintroduced. Which means you are less likely to be hit if you are using Debian Stable (or even Oldstable) than, say, Sid (unpatched at the time of writing this comment) or Arch btw.
11corsicanguppy 5 points in 2 days
You're starting to understand the accidental wins in Enterprise software
5Gurfaild 3 points in 2 days
My OpenMediaVault machine (based on Debian Oldstable) uses OpenSSH 8.4p1, so it's old enough not to have the bug
3