How to fix CVE-2024-6387 – Step-by-Step Guide
CVE-2024-6387, known as 'regreSSHion,' is a critical unauthenticated Remote Code Execution (RCE) vulnerability in OpenSSH. This flaw allows attackers to gain root access on vulnerable glibc-based Linux systems without any authentication. Prompt patching is essential to secure your infrastructure.
What is OpenSSH regreSSHion – Unauthenticated RCE?
The vulnerability, CVE-2024-6387, stems from a signal handler race condition within the OpenSSH server (sshd) process. This race condition can be triggered by an unauthenticated attacker on glibc-based Linux systems. Exploitation leads to arbitrary code execution as the root user, bypassing all authentication mechanisms. It impacts OpenSSH versions 8.5p1 through 9.7p1.
Impact and Risks for your Infrastructure
Successful exploitation of CVE-2024-6387 results in full root compromise of the affected SSH server. Attackers gain complete control over the system, enabling data theft, service disruption, or further network penetration. This unauthenticated RCE poses a severe risk to critical infrastructure.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-6387, update your OpenSSH server to version 9.8p1 or newer immediately. Verify the update by checking the `sshd -V` output to confirm the installed version is 9.8p1 or higher. Restart the sshd service to ensure the patch is fully applied and active.
- 1Upgrade OpenSSH to 9.8p1 or later immediately.
- 2Restrict SSH access via firewall: allow only trusted IPs on port 22.
- 3Enable fail2ban or equivalent rate-limiting to slow exploitation attempts.
- 4Set LoginGraceTime 0 in sshd_config as a temporary workaround (disables grace period).
- 5Audit SSH server logs for exploitation attempts (look for connection floods).
- 6Consider moving SSH to a non-standard port or VPN-only access (Tailscale, WireGuard).