How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, dubbed "OpenSSH regreSSHion," is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting OpenSSH servers. Published on July 1, 2024, it poses a severe risk to systems running vulnerable versions. This flaw allows attackers to gain full control without authentication.
What is OpenSSH regreSSHion – Unauthenticated RCE?
This vulnerability stems from a signal handler race condition within OpenSSH's server daemon (sshd). Specifically, on glibc-based Linux systems, this race condition can be exploited to achieve unauthenticated remote code execution. It impacts OpenSSH versions 8.5p1 through 9.7p1, allowing an attacker to execute arbitrary code as the root user.
Impact and Risks for your Infrastructure
The primary impact is a complete root compromise of the affected SSH server. An attacker can execute arbitrary code with root privileges, gaining full control over the system. This allows for data exfiltration, system manipulation, or further network penetration, posing a critical business and infrastructure risk.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, immediately upgrade your OpenSSH installation to version 9.8p1 or newer. Verify the upgrade by checking the sshd version (sshd -V). Ensure all affected glibc-based Linux systems running OpenSSH 8.5p1-9.7p1 are patched promptly to prevent exploitation.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).