CVE-2024-6387: OpenSSH Remote Code Execution Vulnerability

Description

On July 1, 2024, a security research institute outside China released the latest vulnerability notice on regreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems (CVE-2024-6387). This vulnerability affects OpenSSH with a version of 8.5p1 or later but earlier than 8.8p1-2.r34. sshd invokes insecure asynchronous signal functions in the SIGALRM signal. As a result, an unauthenticated attacker can exploit this vulnerability to execute arbitrary code as user root on the victim's Linux system. This vulnerability has a wide impact. The technical details and PoC of this vulnerability have been disclosed. You are advised to fix the vulnerability in a timely manner.

For details about the HCE SA, see HCE2-SA-2024-0224.

Impacts and Risks

Unauthenticated attackers can exploit this vulnerability to execute arbitrary code as user root on the Linux system, causing confidentiality, integrity, and availability damage.

Identification Method

Check the HCE OS version. If the version is HCE 2.0, go to the next step. If the version is HCE 1.1, the system is not affected by the vulnerability.
```
cat /etc/hce-latest
```
Check the OpenSSH version. If the version is earlier than 8.8p1-2.r34, the OpenSSH is affected by the vulnerability.
```
rpm -qa | grep openssh
```

Solution

Upgrade the OpenSSH version.
```
yum update openssh
```
Verify that the OpenSSH version is 8.8p1-2.r34 or later.
```
rpm -qa | grep openssh
```
Restart the sshd service.
```
systemctl restart sshd
```