Qualys har identifierat en kritisk s\u00e5rbarhet (CVE-2024-6387) i OpenSSH, som m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod med root-beh\u00f6righet utan autentisering. S\u00e5rbarheten, som har kodnamnet regreSSHion, uppkommer i standardkonfigurationen fr\u00e5n version 8.5 av OpenSSH p\u00e5 system med standardbiblioteket Glibc. <\/p>\n
M\u00f6jligheten att genomf\u00f6ra en attack har demonstrerats p\u00e5 ett 32-bitars system med Glibc med aktiverad ASLR-skydd (adressutrymmesrandomisering). F\u00f6r att lyckas med attacken i laboratoriemilj\u00f6 kr\u00e4vdes 6-8 timmar, under vilken tid servern<\/a> konsekvent uppr\u00e4ttades anslutningar med den maximalt till\u00e5tna intensiteten i konfigurationen sshd. Attacken f\u00f6renklas och tar mindre tid p\u00e5 system utan ASLR eller i distributioner som anv\u00e4nder en modifierad OpenSSH, d\u00e4r \u00e5terrandomisering av ASLR f\u00f6r varje anslutning \u00e4r inaktiverad. En fungerande prototyp av exploiten har beslutats att inte publiceras offentligt f\u00f6re vidtagandet av \u00e5tg\u00e4rder mot s\u00e5rbarheten, men det finns en tillr\u00e4ckligt detaljerad beskrivning av s\u00e5rbarhetens natur, vilket g\u00f6r att lanseringen av tredje parts exploits bara \u00e4r en tidsfr\u00e5ga.<\/p>\n M\u00f6jligheten till attack utesluts inte heller f\u00f6r 64-bitars system, men en fungerande exploit f\u00f6r s\u00e5dana system \u00e4r \u00e4nnu inte klar. Det f\u00f6rv\u00e4ntas att genomf\u00f6rande av attacken p\u00e5 64-bitars system kommer att ta mycket l\u00e4ngre tid, dock inte mer \u00e4n en vecka. OpenSSH i OpenBSD \u00e4r inte utsatt f\u00f6r problemet, d\u00e5 detta system har anv\u00e4nt en skyddsmekanism sedan 2001 som blockerar s\u00e5dana typer av attacker. I andra system baserade p\u00e5 standardbibliotek som skiljer sig fr\u00e5n Glibc skulle det teoretiskt vara m\u00f6jligt att anpassa metoden f\u00f6r att genomf\u00f6ra en attack (denna fr\u00e5ga har \u00e4nnu inte unders\u00f6kts av Qualys). <\/p>\n S\u00e5rbarheten har \u00e5tg\u00e4rdats i dagens publicerade version av OpenSSH 9.8 (patch). Du kan f\u00f6lja publiceringen av paketuppdateringar i distributioner p\u00e5 sidorna: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, ROSA, Gentoo, ALT Linux, Arch och FreeBSD. Som en tillf\u00e4llig l\u00f6sning f\u00f6r att blockera s\u00e5rbarheten kan du st\u00e4lla in parametern «LoginGraceTime=0» i sshd_config, vilket inaktiverar timeouten och g\u00f6r det l\u00e4ttare att initiera en \u00f6verbelastningsattack vid en stor m\u00e4ngd anslutningar som \u00f6verskrider gr\u00e4nserna som anges med parametern MaxStartups. S\u00e4kerhetsbristen uppstod som en f\u00f6ljd av en regressiv f\u00f6r\u00e4ndring som ingick i versionen av OpenSSH 8.5, vilket ledde till en kappl\u00f6pning i kodhanteringen av signaler i sshd. Regressionen resulterade i att skyddet mot den \u00e4ldre s\u00e5rbarheten CVE-2006-5051, som visade sig f\u00f6re version OpenSSH 4.4 (2006), och hade teoretisk karakt\u00e4r, upph\u00f6rde att g\u00e4lla. SIGALRM-handlaren anropas i sshd i asynkront l\u00e4ge om klienten inte har genomf\u00f6rt autentisering inom den tid som begr\u00e4nsas av anslutningens timeout (LoginGraceTime, som standard 120 sekunder). Attacken bygger p\u00e5 att signalhanteraren anropar funktioner som inte \u00e4r s\u00e4kra vid asynkron signalbehandling, s\u00e5som syslog(). Funktionen syslog() i Glibc \u00e4r inte avsedd f\u00f6r anv\u00e4ndning i asynkront exekverade signalhandlare, eftersom den anropar funktioner som malloc() och free(). Utl\u00f6sning av SIGALRM-signalen, som avbryter ett visst kodblock i sshd, kan leda till att exekveringsstatusen st\u00f6rs, och uppgiften f\u00f6r exploiten \u00e4r att skapa f\u00f6ruts\u00e4ttningar f\u00f6r att avbryta den n\u00f6dv\u00e4ndiga koden vid r\u00e4tt \u00f6gonblick i dess exekvering. S\u00e5rbarheten p\u00e5verkar inte OpenBSD, eftersom syslog() ist\u00e4llet f\u00f6r att anropas fr\u00e5n SIGALRM-handlaren anropar funktionen syslog_r(), som \u00e4r speciellt utformad f\u00f6r asynkron k\u00f6rning. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f regreSSHion, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 OpenSSH 8.5 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u043e\u0439 Glibc. \u0412\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043d\u0430 32-\u0440\u0430\u0437\u0440\u044f\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 Glibc \u0441 \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 ASLR (\u0440\u0430\u043d\u0434\u043e\u043c\u0438\u0437\u0430\u0446\u0438\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116883","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 S\u00e5rbarhet i OpenSSH som m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod med root-r\u00e4ttigheter p\u00e5 servrar med Glibc | ProHoster","description":"F\u00f6retaget Qualys har identifierat en kritisk s\u00e5rbarhet (CVE-2024-6387) i OpenSSH, vilket m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod med root-r\u00e4ttigheter utan autentisering.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0441 Glibc | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Qualys \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-6387) \u0432 OpenSSH, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-openssh-pozvolyayushhaya-udalyonno-vypolnit-kod-s-pravami-root-na-serverah-s-glibc","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-01T16:05:44+00:00","article:modified_time":"2024-07-01T16:05:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116883","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:59:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 03:18:19","updated":"2026-02-09 21:59:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/116883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=116883"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/116883\/revisions"}],"predecessor-version":[{"id":160364,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/116883\/revisions\/160364"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=116883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=116883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=116883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nEtt av tecknen p\u00e5 f\u00f6rs\u00f6k till attack \u00e4r f\u00f6rekomsten av ett stort antal poster i loggen med «Timeout before authentication».<\/p>\n
\nUnder utvecklingen av OpenSSH 8.5 togs av misstag blocket «#ifdef DO_LOG_SAFE_IN_SIGHAND» bort fr\u00e5n funktionen sigdie(), som kallas direkt fr\u00e5n SIGALRM-hanteraren.<\/p>\n
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"