A new critical security vulnerability has been identified in the OpenSSH server component (sshd), codenamed “regreSSHion” (CVE-2024-6387). This vulnerability, a signal handler race condition, can lead to unauthenticated remote code execution with root privileges on glibc-based Linux systems. The flaw affects OpenSSH versions from 8.5p1 to 9.7p1 and poses a severe risk of full system compromise. Immediate action is required to mitigate potential threats.
Critical Security Flaw in OpenSSH (CVE-2024-6387) Technical Overview
The regreSSHion vulnerability stems from a race condition in the sshd component of OpenSSH, specifically within the SIGALRM signal handler. When a client fails to authenticate within the LoginGraceTime period (120 seconds by default), sshd’s signal handler is invoked in an unsafe manner. This issue, originally patched in CVE-2006-5051, was reintroduced in OpenSSH version 8.5p1 in October 2020. The vulnerability enables remote attackers to execute arbitrary code as root, leading to potential system takeover, malware installation, data theft, and persistent access.
Affected Systems:
- OpenSSH versions from 8.5p1 to 9.7p1.
- Versions prior to 4.4p1 unless patched for CVE-2006-5051 and CVE-2008-4109.
- OpenBSD systems are not affected due to built-in security mechanisms.
Exploitation:
- Successful exploitation demonstrated on 32-bit Linux/glibc systems with Address Space Layout Randomization (ASLR).
- Requires 6-8 hours of continuous connection attempts under lab conditions.
- Exploitability on macOS and Windows remains unconfirmed.
What Our Threat Intelligence Team is Seeing
At Difenda, we have advanced capabilities to detect vulnerabilities such as CVE-2024-6387. Our security monitoring systems are equipped to identify exploitation attempts and anomalous activities related to this critical OpenSSH signal handler race condition, ensuring comprehensive protection and rapid response to potential threats.
What We Suggest for the Critical Security Flaw in OpenSSH (CVE-2024-6387)
- Immediate Patch Application:
- Update OpenSSH servers to version 9.8p1, which addresses this vulnerability.
- Restrict SSH Access:
- Implement network-based controls such as firewalls to limit SSH access.
- Enforce network segmentation to restrict unauthorized access and lateral movement within your infrastructure.
- Configuration Adjustment (Temporary Measure):
- Set LoginGraceTime to 0 in the sshd configuration file. Note: This can increase susceptibility to denial-of-service attacks.
- Monitoring and Detection:
- Utilize security monitoring tools to detect unusual SSH activity and potential exploitation attempts.
- Conduct regular vulnerability scans to identify and address any exposed instances.
What Our Threat Intelligence Team is Doing
Upon detection of any potential vulnerabilities or exploitation attempts, our team promptly informs affected clients and provides detailed guidance on remediation steps. We are committed to ensuring our clients’ environments are secure and resilient against emerging threats.
DIFEND WITH CONFIDENCE