CVE-2024-6387: Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems

Thanks for the share @dips . 

It specifies that versions 8.5p1 to 9.7p1 are confirmed to be vulnerable on 32-bit Linux systems with glibc and ASLR enabled. However, it is noted that exploitation requires between six and eight hours of continuous connections. Additionally, it is speculated that these attacks could be optimized to be faster, especially when ASLR is disabled.

The publisher adds that exploitation on 64-bit systems or systems without glibc seems possible but has not been demonstrated. This vulnerability was discovered by Qualys researchers. They also advise checking for the presence of numerous ‘Timeout before authentication’ lines in logs to detect potential exploitation attempts.

As of July 1, 2024, some Linux distributions have provided patches for vulnerable versions (see the Documentation section). While waiting for patches to become available, Qualys recommends modifying the LoginGraceTime value to 0 in the configuration file. This workaround prevents remote arbitrary code execution but makes the machine vulnerable to remote denial-of-service attacks.

Affected systems:

• OpenSSH versions 8.5p1 to 9.7p1 prior to 9.8 and 9.8p1
• OpenSSH versions 4.4p1

Solution: OpenSSH versions 9.8 and 9.8p1

Thanks for sharing @dips  ...saw this yesterday.

So, it appears 64-bit mostly unaffected (by no known attacks against to this point)?

Welcome! :)

That’s right. Nothing so far from what I have heard on the grapevine. It’s quite noisy so probably why there is not much interest from the bad guys, yet!