Remote Unauthenticated Code Execution Vulnerability in OpenSSH server (CVE-2024-6387)
Description
A race condition vulnerability exists in the signal handler of OpenSSH server (sshd) that allows unauthenticated attackers to execute arbitrary code with root privileges on glibc-based Linux systems. This flaw affects sshd in its default configuration and represents a regression of CVE-2006-5051, a vulnerability that was previously patched in 2006. The vulnerability can be exploited remotely over the network without requiring any user interaction or credentials.
Remediation
Immediately upgrade OpenSSH to version 9.8p1 or later, which contains the fix for this vulnerability. Follow these steps:
1. Verify your current OpenSSH version by running:
sshd -V2. If running a vulnerable version (prior to 9.8p1), update OpenSSH through your system's package manager or by downloading the latest version from the official OpenSSH website
3. After upgrading, restart the SSH service to apply changes
4. Verify the updated version is running
For systems where immediate patching is not possible, implement network-level access controls to restrict SSH access to trusted IP addresses only. Do not rely on configuration changes as a permanent mitigation—upgrading to the patched version is the only complete solution.