TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

CVE-2024-6409: OpenSSH: Possible remote code execution in privsep child

141 pointsby andreyv10 months ago

8 comments

stncls10 months ago
No vulnerability name, no website, concise description, neutral tone, precise list of affected distros (RHEL + derivatives and some EOL Fedoras) and even mention of <i>unaffected</i> distros (current Fedoras), plain admission that no attempt was made to exploit. What a breath of fresh air!<p>(I am only joking of course. As a recovering academic, I understand that researchers need recognition, and I have no right to throw stones -- glass houses and all. Also, this one is really like regreSSHion&#x27;s little sibling. Still, easily finding the information I needed made me happy.)
评论 #40918954 未加载
评论 #40917661 未加载
评论 #40925234 未加载
hannob10 months ago
For clarification, the bug is in a patch applied by red hat, not in openssh itself.
评论 #40916972 未加载
评论 #40919242 未加载
londons_explore10 months ago
Couldn&#x27;t this entire class of bug be solved by annotating signal handlers in the source code and checking at compile time that anything called from a signal handler is async-signal-safe?
评论 #40917941 未加载
评论 #40916977 未加载
评论 #40919257 未加载
评论 #40920519 未加载
评论 #40917506 未加载
qalmakka10 months ago
This is why I&#x27;ve always disliked Debian and Red Hat.<p>1. I hate the fact they have the hubris to think they can be smarter than the upstream developers and patch old versions<p>2. I hate the fact they don&#x27;t ship vanilla packages, but instead insist on patching things for features that nobody relies on anyway, __because they&#x27;re not upstream__.<p>Maintainers should stick to downloading tarballs, building them and updating them promptly when a new version is out. If there&#x27;s no LTS available, pay upstream and get an LTS, don&#x27;t take a random version and patch it forever just to keep the same version numbers, it&#x27;s nonsensical and it was only a matter of time before people tried to exploit it. Just look at the XZ backdoor for instance, which relied on RedHat and Debian deploying a patched libsystemd.
评论 #40917507 未加载
评论 #40919266 未加载
评论 #40918921 未加载
candiddevmike10 months ago
The risk you take when you use a distribution that modifies upstream. Debian has had similar issues in the past (maybe not CVEs, but certainly packager-created bugs).
评论 #40917018 未加载
评论 #40916949 未加载
ta98810 months ago
My understanding here is that it only impacts Redhat (and maybe derivatives)?
评论 #40917117 未加载
password432110 months ago
Is this in any way related to CVE-2024-6387 &quot;RegreSSHion&quot; discussed last week?<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40843778">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40843778</a><p>Edit: Ok it seems very closely related; I was just surprised no one had linked the previous discussion.
crest10 months ago
It&#x27;s almost as if you should understand security critical C code before you start patching it to death.
评论 #40917350 未加载