From ecc0c1fb1244971b2dad96ef2ef886daa80c72fd Mon Sep 17 00:00:00 2001 From: Joachim Wiberg Date: Fri, 5 Jul 2024 08:09:05 +0200 Subject: [PATCH] package/openssh: disable async-signal-unsafe code in sshsigdie() Import Debian patch[1] for CVE-2024-6387[2]. This disables the unsafe syslog code path triggered by SIGALARM. [1] https://salsa.debian.org/ssh-team/openssh/-/blob/master/debian/patches/sshsigdie-async-signal-unsafe.patch [2] https://marc.info/?l=oss-security&m=171982335024767 Signed-off-by: Joachim Wiberg [Peter: rename, add Upstream tag] Signed-off-by: Peter Korsgaard --- .../0002-sshsigdie-async-signal-unsafe.patch | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 package/openssh/0002-sshsigdie-async-signal-unsafe.patch diff --git a/package/openssh/0002-sshsigdie-async-signal-unsafe.patch b/package/openssh/0002-sshsigdie-async-signal-unsafe.patch new file mode 100644 index 0000000000..70a890e469 --- /dev/null +++ b/package/openssh/0002-sshsigdie-async-signal-unsafe.patch @@ -0,0 +1,41 @@ +From 7f4a743171f9e6b283207d448de6562219774fbf Mon Sep 17 00:00:00 2001 +From: Salvatore Bonaccorso +Date: Tue, 25 Jun 2024 12:24:29 +0100 +Subject: Disable async-signal-unsafe code from the sshsigdie() function + +Address signal handler race condition: if a client does not authenticate +within LoginGraceTime seconds (120 by default, 600 in old OpenSSH +versions), then sshd's SIGALRM handler is called asynchronously, but +this signal handler calls various functions that are not +async-signal-safe (for example, syslog()). + +This is a regression from CVE-2006-5051 ("Signal handler race condition +in OpenSSH before 4.4 allows remote attackers to cause a denial of +service (crash), and possibly execute arbitrary code") + +Signed-off-by: Salvatore Bonaccorso +Upstream: https://salsa.debian.org/ssh-team/openssh/-/blob/525bb16e45edac4c03b95e106380d70aecbaf27e/debian/patches/sshsigdie-async-signal-unsafe.patch +Patch-Name: sshsigdie-async-signal-unsafe.patch +--- + log.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/log.c b/log.c +index 6a8b1fc4a..57256660f 100644 +--- a/log.c ++++ b/log.c +@@ -452,12 +452,14 @@ void + sshsigdie(const char *file, const char *func, int line, int showfunc, + LogLevel level, const char *suffix, const char *fmt, ...) + { ++#if 0 + va_list args; + + va_start(args, fmt); + sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL, + suffix, fmt, args); + va_end(args); ++#endif + _exit(1); + } +