Notice of OpenSSH Remote Code Execution Vulnerability (CVE-2024-6387)

OpenSSH is a secure network communication tool based on the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large number of secure tunneling capabilities, multiple authentication methods, and complex configuration options. It is a necessary tool for remote server management and secure data communication.

Description

**Table 1** Vulnerability details
Type	CVE-ID	Severity	Discovered
Privilege escalation	CVE-2024-6387	Critical	2024-07-01

Impact

This vulnerability is caused by a signal handler race condition in OpenSSH's server (sshd). An unauthenticated attacker can exploit this vulnerability to execute arbitrary code as root on Linux.

Identification Method

Check the OS and OpenSSH versions of a node:
- If the OS of a cluster node is EulerOS, Huawei Cloud EulerOS 1.1, or CentOS, the OpenSSH is not affected by this vulnerability.
- If the OS of a cluster node is Huawei Cloud EulerOS 2.0, run the following command to check the version of the installation package:
```
rpm -qa |grep openssh
```
  If the OpenSSH version is earlier than openssh-8.8p1-2.r34 and the SSH port 22 (the default port number for SSH) is used, the system is affected by this vulnerability.
- If the OS of a cluster node is Ubuntu 22.04, run the following command to check the version of the installation package:
```
dpkg -l |grep openssh
```
  If the OpenSSH version is earlier than 1:8.9p1-3ubuntu0.10 and the SSH port 22 (the default port number for SSH) is used, the system is affected by this vulnerability.
Run the following command to check whether the SSH port is used:
```
netstat -tlnp|grep -w 22
```
If the query result shows that the SSH port is listening, it specifies that the SSH access is enabled on the node.

Mitigation

To fix the vulnerability on an existing node, do as follows:

For Ubuntu, upgrade OpenSSH to the fixed version (1:8.9p1-3ubuntu0.10) that is officially released. For details, see the Ubuntu official documentation.

For Huawei Cloud EulerOS 2.0, upgrade OpenSSH to the fixed version (openssh-8.8p1-2.r34) that is officially released. For details, see the CVE-2024-6387: OpenSSH Remote Code Execution Vulnerability.

For new nodes, CCE will provide images with the vulnerability fixed. Pay attention to Patch Versions.