From 8f80def8aa085385dc4fe4668f0e29d3a0dc8510 Mon Sep 17 00:00:00 2001

From: Philip Paeps <philip@FreeBSD.org>

Date: Mon, 1 Jul 2024 16:20:01 +0800

Subject: openssh: Fix pre-authentication remote code execution in sshd.

Reported by:	Qualys Threat Research Unit (TRU)

Approved by:	so

Security:	FreeBSD-SA-24:04.openssh

Security:	CVE-2024-6387

(cherry picked from commit 2abea9df01655633aabbb9bf3204c90722001202)

(cherry picked from commit 620a6a54bb7bb6e1c5607092b6ec49e353e0925f)

---

 crypto/openssh/log.c     | 2 ++

 crypto/openssh/version.h | 2 +-

 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/crypto/openssh/log.c b/crypto/openssh/log.c

index 9fc1a2e2eaf6..436c75630181 100644

--- log.c.orig

+++ log.c

@@ -451,12 +451,14 @@ void

 sshsigdie(const char *file, const char *func, int line, int showfunc,

     LogLevel level, const char *suffix, const char *fmt, ...)

 {

+#if 0

 	va_list args;

 	va_start(args, fmt);

 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,

 	    suffix, fmt, args);

 	va_end(args);

+#endif

 	_exit(1);

 }