An old bug returned to OpenSSH and allowed unauthenticated code execution as root on Linux servers. Why SSH should never be wide open.
Publicly disclosed: 1 July 2024
On 1 July 2024 Qualys published details of a vulnerability in the OpenSSH server (sshd) on glibc-based Linux systems. A race condition in the signal handler — a bug fixed back in 2006 that returned in a later code change, hence the name “regreSSHion” — could allow an unauthenticated attacker to run code as root. Exploitation is difficult and takes many attempts, but it is possible.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-6387 | High, CVSS 8.1 (race condition, remote code execution) | OpenSSH 8.5p1 – 9.7p1 (and versions before 4.4p1) on glibc Linux | OpenSSH 9.8p1 and distribution updates |
LoginGraceTime 0 in sshd_config; this blocks the code execution path but makes it easier to exhaust connection slots.SSH is the key to your servers. Keep the keyhole as small as possible.
Sources: Qualys research, OpenSSH 9.8 release notes, NVD CVE-2024-6387.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.