How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed "OpenSSH regreSSHion," is a critical vulnerability affecting OpenSSH servers. This flaw allows unauthenticated remote code execution (RCE) as root. It poses a severe risk to systems running vulnerable OpenSSH versions.
What is OpenSSH regreSSHion – Unauthenticated RCE?
This vulnerability stems from a signal handler race condition within the OpenSSH server (sshd) process. On glibc-based Linux systems, an attacker can exploit this race condition to achieve unauthenticated remote code execution. It specifically impacts OpenSSH versions 8.5p1 through 9.7p1.
Impact and Risks for your Infrastructure
The primary impact is a full root compromise of the affected SSH server. Attackers can execute arbitrary code with root privileges without any prior authentication. This grants them complete, unmitigated control over the compromised system, leading to severe data breaches and system integrity loss.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, immediately upgrade your OpenSSH server to version 9.8p1 or newer. Verify the fix by checking the installed OpenSSH version using `ssh -V` and ensuring it's 9.8p1+. Regular patching is crucial to prevent exploitation.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).