How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed "regreSSHion," is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting OpenSSH. With a CVSS score of 8.1, it poses a severe risk to affected systems. Immediate action is required to protect your infrastructure.
What is OpenSSH regreSSHion – Unauthenticated RCE?
This vulnerability, CVE-2024-6387, stems from a signal handler race condition within the OpenSSH server (sshd). It allows an unauthenticated attacker to achieve remote code execution as the root user. Specifically, it impacts OpenSSH versions 8.5p1 through 9.7p1 running on glibc-based Linux systems. The race condition can be triggered before authentication completes.
Impact and Risks for your Infrastructure
Exploitation of CVE-2024-6387 leads to full root compromise of the affected SSH server. An attacker can execute arbitrary code with root privileges without prior authentication, gaining complete control. This results in severe data breaches, service disruption, and potential lateral movement within your network.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, immediately upgrade your OpenSSH installation to version 9.8p1 or newer. Verify the upgrade by checking your sshd version (`sshd -V`). Ensure your package manager sources are up-to-date and apply the patch promptly to secure your systems.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).