Race Condition Affecting openssh-portable package, versions [8.5p1,9.8p1)

Affected versions of this package are vulnerable to Race Condition in OpenSSH's server (sshd) due to a signal handler race condition when a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions).

An attacker can execute arbitrary code as root by exploiting the asynchronous call of the SIGALRM handler, which invokes functions that are not async-signal-safe, such as syslog(). This vulnerability can be exploited by repeated connection attempts that exploit the inconsistent state caused by the interrupted signal handler.

This vulnerability mainly derives from the accidental removal of the #ifdef DO_LOG_SAFE_IN_SIGHAND from sigdie()

Note:

1. Under lab conditions, the attack requires, on average, 6-8 hours of continuous connections up to the maximum the server will accept.

2. OpenBSD is notably not vulnerable.

3. This vulnerability is exploitable remotely on glibc-based Linux systems, where syslog() itself calls async-signal-unsafe functions (for example, malloc() and free())

4. Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with ASLR.

5. Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time.

6. Systems that lack ASLR or users of downstream Linux distributions that have modified OpenSSH to disable per-connection ASLR re-randomization may potentially have an easier path to exploitation.

• GitHub Commit
• GitHub Commit
• OSS Security Advisory
• Qualys Blog
• Release Notes