This bug is a masterpiece and you owe it to yourself to read this. So much effort for such a situational bug, it's heartbreakingly beautiful.
https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
The key to it: OpenSSH will open and close dylibs in response to the agent protocol, because that's how it implements smart cards.
Then: ELF lets you mark functions in your dylib that get invoked on open (__attribute__(constructor)) and close (destructor).
Finally: lots of libraries in /usr/lib have constructors with side effects (like registering system call handlers that don't get unregistered because they're never expected to be unloaded, or invoking system call handlers by crashing when you randomly load them). So: UAF primitive.
There's like several thousand words of exposition about how they found the right sequence of opens and closes to set up a signal handler, groom the address space, set the stack executable (another dlopen side effect!), and trigger the signal.
But what makes it :art: is this bit:
"As a last and extreme example of a remote attack against ssh-agent forwarding, we noticed that one shared library's constructor function (which can be invoked by a remote attacker via an ssh-agent forwarding) starts a server thread that listens on a TCP port, and we discovered a remotely exploitable vulnerability (a heap-based buffer overflow) in his server's implementation.”
@Shamar @tqbf What did plan9 do instead which provided similar reduction in resource usage?
I am indeed assuming it did something because I'd just be disappointed if the answer was just "lol suck it up".
Its lack would also make dynamic FFI profoundly annoying to implement, since it'd require the generation of stub programs and IPC.