Qualys has identified a critical vulnerability (CVE-2024-6387) in OpenSSH that allows for remote code execution with root privileges without authentication. The vulnerability, codenamed regreSSHion, manifests in the default configuration starting from OpenSSH version 8.5 on systems with the standard Glibc library.
The attack was demonstrated on a 32-bit system with Glibc and ASLR (Address Space Layout Randomization) protection enabled. In laboratory conditions, it took 6-8 hours to successfully establish connections with the maximum allowed intensity in the sshd configuration. proxy server The attack becomes easier and takes less time on systems without ASLR or in distributions using a modified version of OpenSSH where ASLR re-randomization is disabled for each connection. A working prototype of the exploit has been decided not to be published publicly until the vulnerability is universally fixed, but there is sufficient detailed information about the vulnerability's nature that makes the emergence of third-party exploits a matter of time.
Attacks on 64-bit systems are also possible, but a working exploit for such systems is not ready yet. It is assumed that conducting an attack on 64-bit systems will take significantly more time, but no more than a week. OpenSSH in OpenBSD is not susceptible to this issue, as a protective mechanism blocking such classes of attacks has been in use in that system since 2001. In other systems based on standard libraries different from Glibc, adapting the method for conducting an attack could theoretically be possible (this issue has not yet been studied by Qualys).
The vulnerability has been patched in the newly released OpenSSH 9.8 (patch). Updates for packages in distributions can be tracked on the following pages: Debian, Ubuntu, RHEL, SUSE/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch, and FreeBSD. As a workaround to block the vulnerability, the parameter 'LoginGraceTime=0' can be set in sshd_config; however, disabling the timeout will make it easier to initiate a denial of service when establishing a large number of connections exceeding the limits set by the MaxStartups parameter.
One of the signs of attempted attacks is the appearance of a large number of "Timeout before authentication" entries in the log.
The vulnerability arose from a regression change included in the OpenSSH 8.5 release, which leads to a race condition in the signal handling code in sshd. The regression resulted in the cessation of protection against an older vulnerability CVE-2006-5051, which was theoretical until OpenSSH version 4.4 (2006).
During the development of OpenSSH 8.5, mistakenly, the block "#ifdef DO_LOG_SAFE_IN_SIGHAND" was removed from the sigdie() function, which is directly called from the SIGALRM handler.
The SIGALRM handler is called in sshd asynchronously if the client has not authenticated within the connection timeout (LoginGraceTime, default 120 seconds). The attack relies on the signal handler calling functions that are not safe for asynchronous signal handling, such as syslog(). The syslog() function in Glibc is not designed for use in asynchronously executed signal handlers, as it calls malloc() and free() functions. The SIGALRM signal, interrupting the execution of specific code in sshd, can lead to an execution state violation, and the exploit's task is to create conditions for interrupting the required code at the necessary moment of its execution. The vulnerability does not affect OpenBSD, as in that system, instead of syslog() being called from the SIGALRM signal handler, the syslog_r() function is used, which is specifically designed for asynchronous execution.
Source: opennet.ru
