New OpenSSH Vulnerability: Critical Risk of Remote Code Execution on Linux Systems

The cybersecurity community is once again on high alert following the recent disclosure of a critical vulnerability in OpenSSH, which could lead to unauthenticated remote code execution (RCE) with root privileges on glibc-based Linux systems. This flaw, now assigned the CVE identifier CVE-2024-6387, has prompted immediate action from OpenSSH maintainers, who have released security updates to address the issue.

The Vulnerability Uncovered

CVE-2024-6387 is a serious security flaw found in the OpenSSH server component, known as sshd, which is responsible for listening to connections from client applications. Bharat Jogi, Senior Director of the Threat Research Unit at Qualys, explained the nature of the vulnerability in a recent disclosure. He highlighted that the flaw is a signal handler race condition in sshd, potentially allowing unauthenticated RCE as root on glibc-based Linux systems.

“This race condition affects sshd in its default configuration,” Jogi noted, underlining the wide scope of the potential impact.

A Widespread Issue

Qualys, a prominent cybersecurity firm, identified over 14 million potentially vulnerable OpenSSH server instances exposed to the internet. This vulnerability is particularly concerning as it represents a regression of an older, supposedly patched flaw tracked as CVE-2006-5051. The issue resurfaced in October 2020 with the release of OpenSSH version 8.5p1.

In an advisory, OpenSSH stated that successful exploitation has been demonstrated on 32-bit Linux/glibc systems with Address Space Layout Randomization (ASLR). “Under lab conditions, the attack requires on average 6-8 hours of continuous connections up to the maximum the server will accept,” they elaborated, emphasizing the persistence needed for a successful breach.

Impacted Versions and Security Measures

The vulnerability affects OpenSSH versions from 8.5p1 to 9.7p1, while versions prior to 4.4p1 are also susceptible unless patched for both CVE-2006-5051 and CVE-2008-4109. Notably, OpenBSD systems are immune to this flaw due to a built-in security mechanism that blocks the exploit.

Qualys’s research revealed that the vulnerability arises when a client fails to authenticate within 120 seconds, as defined by the LoginGraceTime setting. In such cases, sshd’s SIGALRM handler is called asynchronously, a process that is not async-signal-safe, leading to potential exploitation.

The Consequences of Exploitation

Exploiting CVE-2024-6387 can result in a full system compromise, enabling attackers to execute arbitrary code with root privileges. This capability allows threat actors to subvert existing security measures, steal data, and maintain persistent access to compromised systems. Jogi stressed the importance of thorough regression testing to prevent such issues, noting that the reintroduction of a previously patched flaw highlights the critical need for vigilance in software development and updates.