Security

684 readers

1 users here now

A community for discussion about cybersecurity, hacking, cybersecurity news, exploits, bounties etc.

Rules :

All instance-wide rules apply.
Keep it totally legal.
Remember the human, be civil.
Be helpful, don't be rude.

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 2 years ago

MODERATORS

LinearArray

CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems (seclists.org)

submitted 5 months ago by 0x0 to c/security

8 comments fedilink hide all child comments

Regression in signal handler.

This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions (for example, malloc() and free()): an unauthenticated remote code execution as root, because it affects sshd's privileged code, which is not sandboxed and runs with full privileges.

you are viewing a single comment's thread
view the rest of the comments

[–] towerful 2 points 5 months ago (1 children)

For an integer, 4 < x < 6 x has to be 5. It's the only value that satisfies all sides of the equation.
You are deriving a set of values for open ssh that satisfies all sides of the equation.

I think it's more of a mathematical representation than programming representation (I mean, I don't know of a language that would accept that syntax).
Certainly psuedocode would have quick statements like this

[–] refalo 2 points 5 months ago (1 children)

seems to work fine in C and I can find quite a bit of examples of it being used actually

[–] towerful 1 points 5 months ago

Oh, I can't find any examples. What are you searching for?
The closest I can find is an old hlsl offhand comment showing the syntax in isolation, but no example.
https://stackoverflow.com/a/29689866