[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Feb 2023 14:59:32 +0000
From: Qualys Security Advisory <qsa@...lys.com>
To: Demi Marie Obenour <demi@...isiblethingslab.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Re: double-free vulnerability in OpenSSH server
9.1 (CVE-2023-25136)
Hi Demi,
On Wed, Feb 22, 2023 at 10:17:19AM -0500, Demi Marie Obenour wrote:
> Is it possible to use this information leak to bypass ASLR without
> crashing the process?
Unfortunately, no: sshd calls _exit() immediately after this information
leak, and fork()s + re-execv()s itself (and therefore re-randomizes its
address space) the next time we connect to it; i.e., a memory address
leaked in one connection is useless in another connection.
> Also, is this flaw expected to be exploitable for code execution on
> GNU/Linux?
We are focusing on OpenBSD for now, because its malloc seems more
compatible with this particular double-free bug than glibc's malloc; we
will look into glibc/Linux at some point, and will keep you posted.
Thank you very much! With best regards,
--
the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
