On June 6, 2024, OpenSSH implemented a fix in commit 81c1099, which relocated the unsafe code from sshd's SIGALRM handler to the listener process, allowing synchronous handling. Qualys and OpenSSH coordinated the release of information regarding this vulnerability on July 1, 2024.
CVE-2024-6387 has emerged as a significant security threat, posing the risk of remote code execution (RCE) within OpenSSH's server (sshd). This critical flaw impacts systems running specific versions of OpenSSH, allowing malicious actors to potentially execute arbitrary code remotely.
Understanding the nature of this vulnerability, its impact, and the necessary mitigation steps is essential for maintaining system security and protecting sensitive information.
What is CVE-2024-6387?
CVE-2024-6387 is a critical signal handler race condition in OpenSSH's server (sshd) that can lead to remote code execution. The issue arises when a client fails to authenticate within the LoginGraceTime period (120 seconds by default). When this timeout occurs, sshd's SIGALRM handler is triggered asynchronously.
Unfortunately, this handler calls functions like syslog(), which are not async-signal-safe, creating a race condition.
This critical flaw was unknowingly introduced in October 2020 with OpenSSH version 8.5p1 due to a commit that altered the logging infrastructure. Specifically, an #ifdef DO_LOG_SAFE_IN_SIGHAND directive was omitted from the sigdie() function, which the SIGALRM handler directly invokes.
This reintroduced a vulnerability (CVE-2006-5051) initially patched in older versions of OpenSSH.
Who is Affected?
The vulnerability impacts OpenSSH versions between 8.5p1 and 9.8p1.
Notably, systems running glibc-based Linux distributions are particularly at risk. The syslog() function in these environments calls async-signal-unsafe functions such as malloc() and free(), potentially allowing a remote attacker to execute code with root privileges. This could lead to unauthorized access and control over affected systems.
How to Mitigate the Vulnerability
The primary recommendation and most efficient way to address this vulnerability is to patch affected systems immediately. This package is now available in most package managers and can also be patched with Automox.
For those unable to apply the patch immediately, setting LoginGraceTime to 0 in the configuration file offers a temporary workaround. This change prevents the remote code execution risk but introduces a denial-of-service vulnerability by exhausting all MaxStartups connections. It is crucial to apply the permanent fix as soon as possible.
Patch Now
CVE-2024-6387 presents a significant threat to systems relying on OpenSSH for secure communication. By understanding this vulnerability's mechanics and promptly applying the necessary patches, organizations can protect their infrastructure from potential attacks. Continuous collaboration and vigilance in the cybersecurity community remain essential in addressing such threats and maintaining robust security postures.
For detailed technical information and to access the patch, refer to the latest OpenSSH release notes and the Qualsys security advisory.
Start your free trial now.
Get started with Automox in no time.
By submitting this form you agree to our Master Services Agreement and Privacy Policy
