OpenSSH maintainers have released security updates to contain a critical security flaw that could lead to unauthenticated remote code execution with root privileges on glibc-based Linux systems.
The vulnerability has been assigned the CVE identifier CVE-2024-6387. It resides in the OpenSSH server component , also known as sshd, which is designed to listen for connections from any client application.
“The vulnerability, which is a race condition in the signal handler in the OpenSSH server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems,” said Bharat Jogi, senior director of Qualys’ threat research unit, in a statement released today. “This race condition affects sshd in its default configuration.”
A race condition is a situation in which the behavior of a software program depends on the sequence or timing of unsynchronized operations. This problem often occurs in concurrent or multi-threaded systems, where two or more processes or threads attempt to access or modify a shared resource simultaneously. If not handled properly, race conditions can cause unpredictable behavior, programming errors, and security vulnerabilities. In the security field, a race condition can be exploited by an attacker to perform unauthorized actions, access sensitive data, or compromise the integrity of the system, making the implementation of appropriate synchronization and access control techniques crucial.
The cybersecurity firm said it has identified no fewer than 14 million potentially vulnerable OpenSSH server instances exposed across the internet, adding that this is a regression of an 18-year-old flaw already patched and identified as CVE-2006-5051 , with the issue reverted in October 2020 as part of OpenSSH version 8.5p1.
“Successful exploitation has been demonstrated on 32-bit Linux/glibc systems with [ address space layout randomization ],” OpenSSH said in a warning. “Under lab conditions, the attack requires an average of 6-8 hours of continuous connections up to the maximum the server will accept.”
The vulnerability impacts versions between 8.5p1 and 9.7p1. Versions prior to 4.4p1 are also vulnerable to the race condition bug unless they are patched for CVE-2006-5051 and CVE-2008-4109 . It's worth noting that OpenBSD systems are not affected, as they include a safety mechanism that blocks the flaw.
Specifically, Qualys discovered that if a client does not authenticate within 120 seconds (a setting defined by LoginGraceTime), sshd's SIGALRM handler is called asynchronously, in a way that is not async-signal-safe.
The net effect of exploiting CVE-2024-6387 is complete system compromise and control, allowing threat actors to execute arbitrary code with the highest privileges, subvert security mechanisms, steal data, and even maintain an access persistent.
“A flaw, once fixed, has reappeared in a subsequent software release, typically due to changes or updates that inadvertently reintroduce the problem,” Jogi said. “This incident highlights the crucial role of thorough regression testing to prevent the reintroduction of known vulnerabilities into the environment.”
While the vulnerability presents significant challenges due to its remote race condition nature, users are advised to apply the latest patches to protect themselves from potential threats . It is also recommended to restrict SSH access using network-based controls such as firewalling and enforce network segmentation to limit unauthorized access and lateral movement.
