Recent searches
Search options
OpenSSH sshd on musl-based systems is not vulnerable to RCE via CVE-2024-6387 (regreSSHion).
This is because we do not use localtime in log timestamps and do not use dynamic allocation (because it could fail under memory pressure) for printf formatting.
While the sshd bug is UB (AS-unsafe syslog call from signal context), very deliberate decisions we made for other good reasons reduced the potential impact to deadlock taking a lock.
@musl I'll use musl when most software I use doesn't depend on glibc extensions.
@dusnm @musl The point isn't always getting you to use it. Use what works for you. Sometimes the point is proving the benefits of the implementation choices we made and encouraging their adoption. A big motivation of musl has always been motivating glibc to be better, so you win even if you don't use it.