Spole\u010dnost Qualys odhalila kritickou zranitelnost (CVE-2024-6387) v OpenSSH, umo\u017e\u0148uj\u00edc\u00ed vzd\u00e1len\u00e9 prov\u00e1d\u011bn\u00ed k\u00f3du s pr\u00e1vy root bez autentizace. Zranitelnost, kter\u00e1 byla pojmenov\u00e1na regreSSHion, se projevuje v konfiguraci o defaultu od verze OpenSSH 8.5 na syst\u00e9mech se standardn\u00ed knihovnou Glibc. <\/p>\n
Mo\u017enost proveden\u00ed \u00fatoku byla demonstrov\u00e1na na 32bitov\u00e9m syst\u00e9mu s Glibc se zapnutou ochranou ASLR (n\u00e1hodn\u00e1 organizace adresn\u00edho prostoru). Pro \u00fasp\u011b\u0161n\u00fd \u00fatok v laboratorn\u00edch podm\u00ednk\u00e1ch bylo zapot\u0159eb\u00ed 6-8 hodin, b\u011bhem nich\u017e byly st\u00e1le navazov\u00e1ny spojen\u00ed s maxim\u00e1ln\u00ed intenzitou povolenou v konfiguraci sshd. serverem<\/a> Prov\u00e1d\u011bn\u00ed \u00fatoku je usnadn\u011bno a vy\u017eaduje m\u00e9n\u011b \u010dasu na syst\u00e9mech bez ASLR nebo v distribuc\u00edch, kter\u00e9 pou\u017e\u00edvaj\u00ed modifikovan\u00fd OpenSSH, v n\u011bm\u017e je vypnuta op\u011btovn\u00e1 n\u00e1hodn\u00e1 organizace ASLR pro ka\u017ed\u00e9 spojen\u00ed. Pracovn\u00ed prototyp exploitu p\u0159ed celkov\u00fdm odstran\u011bn\u00edm zranitelnosti nen\u00ed pl\u00e1nov\u00e1no zve\u0159ej\u0148ovat ve\u0159ejn\u011b, av\u0161ak k dispozici je dostate\u010dn\u011b podrobn\u00fd popis podstaty zranitelnosti, kter\u00fd \u010din\u00ed objevov\u00e1n\u00ed t\u0159et\u00edch stran exploitu ot\u00e1zkou \u010dasu.<\/p>\n Nelze vylou\u010dit mo\u017enost proveden\u00ed \u00fatoku i na 64bitov\u00e9 syst\u00e9my, ale funk\u010dn\u00ed exploit pro takov\u00e9 syst\u00e9my zat\u00edm nen\u00ed p\u0159ipraven. P\u0159edpokl\u00e1d\u00e1 se, \u017ee proveden\u00ed \u00fatoku na 64bitov\u00e9 syst\u00e9my bude trvat mnohem d\u00e9le, ale ne d\u00e9le ne\u017e t\u00fdden. OpenSSH v OpenBSD na tuto problematiku nen\u00ed n\u00e1chyln\u00e9, proto\u017ee v tomto syst\u00e9mu je od roku 2001 pou\u017e\u00edv\u00e1n ochrann\u00fd mechanismus, kter\u00fd blokuje podobn\u00e9 t\u0159\u00eddy \u00fatok\u016f. V jin\u00fdch syst\u00e9mech na b\u00e1zi standardn\u00edch knihoven odli\u0161n\u00fdch od Glibc je teoreticky mo\u017en\u00e1 adaptace metody k proveden\u00ed \u00fatoku (toto t\u00e9ma zat\u00edm v Qualys nebylo zkoum\u00e1no). <\/p>\n Zranitelnost byla odstran\u011bna v dnes zve\u0159ejn\u011bn\u00e9 verzi OpenSSH 9.8 (z\u00e1plata). Aktu\u00e1ln\u00ed informace o publikaci aktualizac\u00ed bal\u00edk\u016f v distribuc\u00edch lze sledovat na str\u00e1nk\u00e1ch: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch a FreeBSD. Jako obch\u00e1z\u00ed blokov\u00e1n\u00ed zranitelnosti v sshd_config m\u016f\u017eete nastavit parametr \u201eLoginGraceTime=0\u201c, p\u0159i\u010dem\u017e deaktivace \u010dasov\u00e9ho limitu usnadn\u00ed iniciaci odm\u00edtnut\u00ed slu\u017eeb p\u0159i nastaven\u00ed velk\u00e9ho po\u010dtu p\u0159ipojen\u00ed, kter\u00e1 p\u0159ekra\u010duj\u00ed limity nastaven\u00e9 parametrem MaxStartups. Zranitelnost vznikla v d\u016fsledku regresn\u00ed zm\u011bny, kter\u00e1 byla sou\u010d\u00e1st\u00ed vyd\u00e1n\u00ed OpenSSH 8.5 a vedla k z\u00e1vodn\u00edmu stavu v k\u00f3du zpracov\u00e1n\u00ed sign\u00e1l\u016f v sshd. Regrese vedla k ukon\u010den\u00ed \u00fa\u010dinnosti ochrany p\u0159ed starou zranitelnost\u00ed CVE-2006-5051, kter\u00e1 se projevovala do verze OpenSSH 4.4 (rok 2006) a m\u011bla teoretick\u00fd charakter. Obsluha SIGALRM se ve sshd vyvol\u00e1v\u00e1 asynchronn\u011b, pokud se klient b\u011bhem \u010dasov\u00e9ho limitu p\u0159ipojen\u00ed (LoginGraceTime, v\u00fdchoz\u00ed hodnota 120 sek) neautentizoval. \u00datok je zalo\u017een na tom, \u017ee obsluha sign\u00e1lu vol\u00e1 funkce, kter\u00e9 nejsou bezpe\u010dn\u00e9 p\u0159i asynchronn\u00edm zpracov\u00e1n\u00ed sign\u00e1l\u016f, jako je syslog(). Funkce syslog() v Glibc nen\u00ed navr\u017eena pro pou\u017eit\u00ed v asynchronn\u011b prov\u00e1d\u011bn\u00fdch obsluh\u00e1ch sign\u00e1l\u016f, proto\u017ee vol\u00e1 funkce malloc() a free(). Vyvol\u00e1n\u00ed sign\u00e1lu SIGALRM, kter\u00e9 p\u0159eru\u0161uje b\u011bh ur\u010dit\u00e9ho k\u00f3du v sshd, m\u016f\u017ee v\u00e9st k poru\u0161en\u00ed stavu prov\u00e1d\u011bn\u00ed, a \u00faloha exploit je vytv\u00e1\u0159et podm\u00ednky pro p\u0159eru\u0161en\u00ed pot\u0159ebn\u00e9ho k\u00f3du ve spr\u00e1vn\u00e9m okam\u017eiku jeho prov\u00e1d\u011bn\u00ed. Zranitelnost se nedot\u00fdk\u00e1 OpenBSD, proto\u017ee zde m\u00edsto syslog() z obsluhy sign\u00e1lu SIGALRM je vol\u00e1na funkce syslog_r(), speci\u00e1ln\u011b vytvo\u0159en\u00e1 pro asynchronn\u00ed spu\u0161t\u011bn\u00ed. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v OpenSSH, kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00e9 proveden\u00ed k\u00f3du s pr\u00e1vy root na serverech s Glibc | ProHoster","description":"Spole\u010dnost Qualys odhalila kritickou zranitelnost (CVE-2024-6387) v OpenSSH, kter\u00e1 umo\u017e\u0148uje vzd\u00e1len\u00e9 prov\u00e1d\u011bn\u00ed k\u00f3du s pr\u00e1vy root bez autentizace.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nJedn\u00edm z p\u0159\u00edznak\u016f pokusu o \u00fatok je v\u00fdskyt velk\u00e9ho mno\u017estv\u00ed z\u00e1znam\u016f \u201eTimeout before authentication\u201c v logu.<\/p>\n
\nB\u011bhem v\u00fdvoje OpenSSH 8.5 byla omylem odstran\u011bna \u010d\u00e1st \u201e#ifdef DO_LOG_SAFE_IN_SIGHAND\u201c z funkce sigdie(), kter\u00e1 je p\u0159\u00edmo vol\u00e1na z obslu\u017en\u00e9ho programu SIGALRM.<\/p>\n
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"