RetroFed Forum
Your home away from modern life.
CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems
Post Reply
AuthorMessage
0x0 programming.dev 0x0@programming.dev
Joined: 2023-06-30
Quote

Regression in signal handler.

This vulnerability is exploitable remotely on glibc-based Linux systems,
where syslog() itself calls async-signal-unsafe functions (for example,
malloc() and free()): an unauthenticated remote code execution as root,
because it affects sshd's privileged code, which is not sandboxed and
runs with full privileges.

1   Original
Post Reply
Back to top