Major OpenSSH Vulnerability Uncovered: Immediate Patch Recommended
A new security vulnerability in OpenSSH, labeled as CVE-2024-6387, has emerged, posing a significant threat to Linux systems by allowing unauthenticated remote code execution (RCE) with root privileges. This critical flaw has been coined “regreSSHion” and is a signal handler race condition found in the OpenSSH server component, commonly known as sshd.
Understanding the Vulnerability
Bharat Jogi, the senior director of the threat research unit at Qualys, explained in a recent disclosure that this vulnerability stems from a signal handler race condition in sshd’s default configuration. This flaw could enable attackers to execute arbitrary code with root privileges on glibc-based Linux systems. The issue is particularly concerning as it affects OpenSSH versions between 8.5p1 and 9.7p1. Additionally, systems with versions prior to 4.4p1 remain vulnerable unless they have been patched for the previous flaws CVE-2006-5051 and CVE-2008-4109.
Historical Context and Impact
The regreSSHion flaw is essentially a regression of an 18-year-old vulnerability that was thought to have been patched. It reappeared in October 2020 as part of the OpenSSH 8.5p1 release. According to Qualys, there are potentially 14 million OpenSSH server instances exposed to the internet that could be vulnerable to this flaw. Successful exploitation of this vulnerability has been demonstrated on 32-bit Linux/glibc systems with address space layout randomization (ASLR), taking approximately 6-8 hours of continuous connection attempts under controlled conditions.
Platform-Specific Concerns
While Linux systems are the primary targets, there is concern that macOS and Windows platforms might also be affected. However, the exploitability on these systems has yet to be confirmed and requires further investigation. Notably, OpenBSD systems are immune to this flaw due to an inherent security mechanism that prevents the vulnerability.
Exploitation Details
The vulnerability can be triggered if a client does not authenticate within 120 seconds, causing sshd’s SIGALRM handler to be called asynchronously in an unsafe manner. This opens the door for a full system compromise, allowing attackers to bypass security measures, steal data, and maintain persistent access.
Preventive Measures and Recommendations
To mitigate the risk, users are strongly advised to apply the latest OpenSSH patches immediately. It is also recommended to restrict SSH access using network-based controls and enforce network segmentation to limit unauthorized access and lateral movement within the network.
Bharat Jogi emphasized the importance of thorough regression testing to prevent such vulnerabilities from resurfacing. He noted, “A flaw, once fixed, has reappeared in a subsequent software release, typically due to changes or updates that inadvertently reintroduce the issue.”
Conclusion
This critical vulnerability in OpenSSH underscores the ongoing challenges in maintaining secure software environments. Users must act swiftly to patch their systems and implement recommended security measures to protect against potential exploitation.
