{"id":116883,"date":"2024-07-01T18:05:44","date_gmt":"2024-07-01T16:05:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc"},"modified":"2024-07-01T18:05:44","modified_gmt":"2024-07-01T16:05:44","slug":"uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","title":{"rendered":"Podatno\u015b\u0107 w OpenSSH, umo\u017cliwiaj\u0105ca zdalne wykonanie kodu z uprawnieniami roota na serwerach z Glibc","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Firma Qualys wykry\u0142a krytyczn\u0105 luk\u0119 (CVE-2024-6387) w OpenSSH, kt\u00f3ra umo\u017cliwia zdalne wykonanie kodu z uprawnieniami root bez przechodzenia przez uwierzytelnianie. Luka, kt\u00f3ra otrzyma\u0142a kodow\u0105 nazw\u0119 regreSSHion, wyst\u0119puje w domy\u015blnej konfiguracji od wersji OpenSSH 8.5 na systemach z standardow\u0105 bibliotek\u0105 Glibc. <\/p>\n

Mo\u017cliwo\u015b\u0107 przeprowadzenia ataku zosta\u0142a zademonstrowana na 32-bitowym systemie z Glibc z w\u0142\u0105czon\u0105 ochron\u0105 ASLR (losowanie przestrzeni adresowej). Do udanego ataku w warunkach laboratoryjnych potrzebne by\u0142o 6-8 godzin, podczas kt\u00f3rych serwerem<\/a> nieprzerwanie nawi\u0105zywane by\u0142y po\u0142\u0105czenia z maksymaln\u0105 dopuszczaln\u0105 w konfiguracji sshd intensywno\u015bci\u0105. Przeprowadzenie ataku jest \u0142atwiejsze i wymaga mniej czasu na systemach bez ASLR lub w dystrybucjach wykorzystuj\u0105cych zmodyfikowany OpenSSH, w kt\u00f3rym wy\u0142\u0105czono ponowne losowanie ASLR dla ka\u017cdego po\u0142\u0105czenia. Postanowiono nie publikowa\u0107 publicznie dzia\u0142aj\u0105cego prototypu exploit'a do momentu ca\u0142kowitego usuni\u0119cia luki, ale dost\u0119pny jest wystarczaj\u0105co szczeg\u00f3\u0142owy opis istoty luki, co sprawia, \u017ce pojawienie si\u0119 zewn\u0119trznych exploit\u00f3w jest kwesti\u0105 czasu.<\/p>\n

Nie mo\u017cna wykluczy\u0107 mo\u017cliwo\u015bci przeprowadzenia ataku na 64-bitowe systemy, jednak dzia\u0142aj\u0105cy exploit dla takich system\u00f3w na razie nie jest gotowy. Uwa\u017ca si\u0119, \u017ce przeprowadzenie ataku na 64-bitowe systemy zajmie znacznie wi\u0119cej czasu, ale nie wi\u0119cej ni\u017c tydzie\u0144. OpenSSH w OpenBSD nie jest podatny na ten problem, poniewa\u017c od 2001 roku w tym systemie stosowany jest mechanizm zabezpieczaj\u0105cy, blokuj\u0105cy tego typu ataki. W innych systemach opartych na standardowych bibliotekach, innych ni\u017c Glibc, teoretycznie mo\u017cliwa jest adaptacja metody do przeprowadzenia ataku (w firmie Qualys ten temat nie zosta\u0142 jeszcze zbadany). <\/p>\n

Vulnerability fixed in today's release of OpenSSH 9.8 (patch). You can track the publication of package updates in distributions on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch, and FreeBSD. As a workaround to block the vulnerability in sshd_config, the parameter «LoginGraceTime=0» can be set; however, disabling the timeout will simplify the initiation of denial-of-service in the case of a high number of connections exceeding the limits set by the MaxStartups parameter.
\nOne of the signs of attempted attacks is the appearance of a large number of «Timeout before authentication» entries in the log.<\/p>\n

Vulnerability appeared as a result of a regression change included in the OpenSSH 8.5 release, leading to a race condition in the signal handling code in sshd. The regression disabled the protection against an older vulnerability CVE-2006-5051, which manifested itself before version OpenSSH 4.4 (2006 year) and was of a theoretical nature.
\nDuring the development of OpenSSH 8.5, the «#ifdef DO_LOG_SAFE_IN_SIGHAND» block was mistakenly removed from the sigdie() function, which is called directly from the SIGALRM handler.<\/p>\n

Obs\u0142uga SIGALRM jest wywo\u0142ywana w sshd w trybie asynchronicznym, je\u015bli klient nie zako\u0144czy\u0142 procesu autoryzacji w czasie ograniczonym przez timeout po\u0142\u0105czenia (LoginGraceTime, domy\u015blnie 120 sek). Atak opiera si\u0119 na tym, \u017ce obs\u0142uga sygna\u0142u wywo\u0142uje funkcje, kt\u00f3re nie s\u0105 bezpieczne przy asynchronicznym przetwarzaniu sygna\u0142\u00f3w, takie jak syslog(). Funkcja syslog() w Glibc nie jest zaprojektowana do u\u017cycia w asynchronicznie wykonywanych obs\u0142ugach sygna\u0142\u00f3w, poniewa\u017c wywo\u0142uje funkcje malloc() i free(). Wyst\u0105pienie sygna\u0142u SIGALRM, kt\u00f3ry przerywa dzia\u0142anie okre\u015blonego kodu w sshd, mo\u017ce prowadzi\u0107 do zak\u0142\u00f3cenia stanu wykonania, a celem exploita jest stworzenie warunk\u00f3w do przerwania odpowiedniego kodu w odpowiednim momencie wykonania. Wra\u017cliwo\u015b\u0107 nie dotyczy OpenBSD, poniewa\u017c w nim zamiast syslog() z obs\u0142ugi sygna\u0142u SIGALRM wywo\u0142ywana jest funkcja syslog_r(), specjalnie stworzona do asynchronicznego uruchamiania.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wra\u017cliwo\u015b\u0107 w OpenSSH, umo\u017cliwiaj\u0105ca zdalne wykonanie kodu z uprawnieniami root na serwerach z Glibc | ProHoster","description":"Firma Qualys zidentyfikowa\u0142a krytyczn\u0105 wra\u017cliwo\u015b\u0107 (CVE-2024-6387) w OpenSSH, kt\u00f3ra umo\u017cliwia zdalne wykonanie kodu z uprawnieniami root bez konieczno\u015bci przechodzenia autoryzacji.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}