How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed 'OpenSSH regreSSHion', is a critical vulnerability affecting OpenSSH versions 8.5p1 through 9.7p1. This flaw allows unauthenticated remote code execution, posing a severe threat to glibc-based Linux systems. Immediate action is required to protect your infrastructure.
What is OpenSSH regreSSHion – Unauthenticated RCE?
CVE-2024-6387 stems from a signal handler race condition within the OpenSSH server (sshd). This critical flaw permits unauthenticated remote code execution as root on vulnerable glibc-based Linux systems. Exploiting this race condition grants an attacker full control over the compromised server without needing credentials. It specifically impacts OpenSSH versions 8.5p1 to 9.7p1.
Impact and Risks for your Infrastructure
The impact of CVE-2024-6387 is a full root compromise of the affected SSH server. An attacker can execute arbitrary code with root privileges, gaining complete control over the system. This leads to potential data exfiltration, service disruption, and further lateral movement within your network infrastructure.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, immediately upgrade your OpenSSH installation to version 9.8p1 or newer. Verify the fix by checking your OpenSSH version using `ssh -V` and ensuring it is 9.8p1 or higher. Apply patches promptly to all affected glibc-based Linux systems running OpenSSH 8.5p1-9.7p1.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).