Not Again! Another OpenSSH Vulnerability Discovered with Potential RCE (CVE-2024-6409)

Another vulnerability discovered in select versions of the OpenSSH secure networking suite poses a significant threat, potentially enabling remote code execution (RCE). This vulnerability, identified as CVE-2024-6409, carries a CVSS score of 7.0, reflecting its severity. It is distinct from the recently disclosed CVE-2024-6387, also known as RegreSSHion, and involves a race condition in signal handling within the privsep child process. Importantly, this issue affects versions 8.7p1 and 8.8p1 of OpenSSH that are shipped with Red Hat Enterprise Linux 9.

Discovery and Reporting

The credit for discovering and reporting this vulnerability goes to security researcher Alexander Peslyak, who is widely known by his alias, Solar Designer. The vulnerability was identified during a review of CVE-2024-6387, which had been disclosed earlier this month by the cybersecurity firm Qualys.

Peslyak provided insights into the differences between CVE-2024-6409 and CVE-2024-6387. “The main difference from CVE-2024-6387 is that the race condition and RCE potential are triggered in the privsep child process, which runs with reduced privileges compared to the parent server process,” Peslyak explained. “So the immediate impact is lower. However, there may be differences in the exploitability of these vulnerabilities in a particular scenario, which could make either one of these a more attractive choice for an attacker, and if only one of these is fixed or mitigated then the other becomes more relevant.”

Technical Details

At its core, the signal handler race condition vulnerability in CVE-2024-6409 mirrors that of CVE-2024-6387. When a client fails to authenticate within the LoginGraceTime seconds (default is 120), the OpenSSH daemon process’ SIGALRM handler is invoked asynchronously. This invocation leads to the execution of various functions that are not async-signal-safe, thereby creating a window of vulnerability.

According to the vulnerability description, this issue makes the privsep child process of the SSHD server susceptible to the same signal handler race condition vulnerability as CVE-2024-6387. “As a consequence of a successful attack, in the worst-case scenario, the attacker may be able to perform a remote code execution (RCE) within the unprivileged user running the sshd server.”

Real-World Implications and Exploitation

The implications of this vulnerability are significant, given the widespread use of OpenSSH in securing network communications. An active exploit for CVE-2024-6387 has already been detected in the wild, indicating a high likelihood that CVE-2024-6409 could also be targeted. Reports have surfaced about an unknown threat actor exploiting servers primarily located in China.

Israeli cybersecurity company Veriti has shed light on the nature of these attacks. “The initial vector of this attack originates from the IP address 108.174.58[.]28, which was reported to host a directory listing exploit tools and scripts for automating the exploitation of vulnerable SSH servers,” Veriti noted. This discovery underscores the urgency of addressing these vulnerabilities promptly to prevent potential exploits.