How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, known as 'regreSSHion', is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting OpenSSH servers. This flaw allows attackers to compromise vulnerable systems without prior authentication, posing a severe security risk.
What is OpenSSH regreSSHion – Unauthenticated RCE?
The vulnerability arises from a signal handler race condition in OpenSSH's server (sshd). It specifically impacts OpenSSH versions 8.5p1 through 9.7p1 running on glibc-based Linux systems. This race condition can be exploited to achieve unauthenticated remote code execution as the root user.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-6387 leads to full root compromise of the affected SSH server. Attackers gain complete control, enabling arbitrary code execution, data exfiltration, and further network penetration. This poses a critical threat to infrastructure integrity and data confidentiality.
Step-by-Step Mitigation Guide
To fix CVE-2024-6387, update OpenSSH to version 9.8p1 or later immediately. Verify the update by checking your OpenSSH version (`ssh -V`) and confirming it's 9.8p1+. Restart the sshd service to ensure the patch is active. Apply vendor-provided patches if direct upgrade is not feasible.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).