How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed 'regreSSHion', is a critical vulnerability affecting OpenSSH servers. This flaw allows unauthenticated remote code execution (RCE) as root on vulnerable glibc-based Linux systems. Immediate action is required to protect your infrastructure.
What is OpenSSH regreSSHion – Unauthenticated RCE?
CVE-2024-6387 stems from a signal handler race condition within OpenSSH's `sshd` server process. This critical flaw enables an attacker to achieve unauthenticated remote code execution with root privileges. Specifically, it impacts OpenSSH versions 8.5p1 through 9.7p1 running on glibc-based Linux distributions.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-6387 leads to a full root compromise of the affected SSH server. Attackers gain complete, unauthenticated control over the system, allowing for arbitrary code execution. This can result in data exfiltration, service disruption, and further network penetration.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, update your OpenSSH installation to version 9.8p1 or newer immediately. Verify the update by checking your `sshd` version (`sshd -V` or `ssh -V`). Ensure all glibc-based Linux systems running OpenSSH 8.5p1-9.7p1 are patched to prevent unauthenticated RCE.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).