CVE-2024-6387（SSH远程RCE!!! 是核弹还是鸡肋？）

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

For this attack against Ubuntu 6.06.1, we simply re-used the timing strategy that we used against Debian 3.0r6: it takes ~10,000 tries on average to win the race condition, and with 10 connections accepted per 120 seconds, it takes ~1-2 days on average to remote root shell.对于这次针对Ubuntu 6.06.1的攻击，我们只是重新使用了针对Debian 3.0r6的计时策略：平均需要约10000次尝试才能赢得比赛条件，并且每120秒接受10个连接，远程根外壳平均需要约1-2天。Note: because this Ubuntu's glibc always takes a mandatory lock when entering the functions of the malloc family, an unlucky attacker might deadlock all 10 MaxStartups connections before obtaining a root shell;注意：由于这个Ubuntu的glibc在进入malloc家族的功能时总是使用强制锁，因此不幸的攻击者可能会在获得根shell之前将所有10个MaxStartups连接死锁；