Some versions of the OpenSSH secure networking suite have been found vulnerable to a new exploit that could lead to remote code execution (RCE).
The flaw, identified as CVE-2024-6409 (CVSS score: 7.0), differs from CVE-2024-6387 (also known as RegreSSHion), and it stems from a code execution bug in the privsep child process due to a timing issue in handling signals. It affects only versions 8.7p1 and 8.8p1 provided with Red Hat Enterprise Linux 9.
Security specialist Alexander Peslyak, who uses the alias Solar Designer, was the one to discover and report this vulnerability during an assessment of CVE-2024-6387 post its disclosure by Qualys earlier in this month.
“The primary difference from CVE-2024-6387 lies in the fact that the race issue and RCE potential are activated in the privsep child process, which operates with restricted permissions as compared to the main server process,” noted Peslyak in his message.
“This means the immediate impact is less severe. Nevertheless, there might be variations in the exploitability of these vulnerabilities in a given context, which could make either of them more appealing for an attacker, and fixing or mitigating only one of them would make the other more significant.”
However, it is important to mention that the signal handling timing problem is the same as that of CVE-2024-6387, where if a client fails to authenticate within the default LoginGraceTime duration (which is 120 seconds), the OpenSSH daemon process’ signal handler (SIGALRM) gets asynchronously triggered, thereby calling various functions that are not signal-safe in an async context.
“This vulnerability exposes it to a signal handler timing issue in the cleanup_exit() function, leading to a similar vulnerability as observed in CVE-2024-6387 within the non-privileged child process of the SSHD server,” as stated in the description of the flaw.
“In a worst-case scenario of a successful breach, the attacker could potentially execute remote code on the non-privileged user running the sshd server.”
An active attack exploiting CVE-2024-6387 has been spotted in the wild, with an unidentified threat agent targeting servers mainly in China.
“This attack initially traces back to the IP address 108.174.58[.]28, known to host a collection of exploit tools and scripts for automating the compromise of vulnerable SSH servers,” disclosed Israeli cybersecurity firm Veriti in their statement.
About Author
