How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed 'OpenSSH regreSSHion', is a critical unauthenticated remote code execution vulnerability affecting OpenSSH. This flaw poses a severe risk to glibc-based Linux systems running vulnerable OpenSSH versions.
What is OpenSSH regreSSHion – Unauthenticated RCE?
This vulnerability stems from a signal handler race condition within the OpenSSH server (sshd). An unauthenticated attacker can exploit this race condition to execute arbitrary code with root privileges. It specifically impacts OpenSSH versions 8.5p1 through 9.7p1 on glibc-based Linux distributions, allowing full system compromise.
Impact and Risks for your Infrastructure
The impact of CVE-2024-6387 is catastrophic, leading to full root compromise of affected SSH servers. Attackers gain complete control over the system, enabling data exfiltration, service disruption, or further network penetration. This critical flaw requires immediate attention to prevent severe security breaches.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, upgrade OpenSSH to version 9.8p1 or later immediately. Verify the update by checking your OpenSSH version using `ssh -V` and ensuring it reports 9.8p1+. Restart the sshd service after the upgrade to apply the patch effectively.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).