OpenSSH up to 9.8 on Linux Signal grace_alarm_handler regreSSHion race condition

Summaryinfo

A vulnerability identified as critical has been detected in OpenSSH up to 9.8 on Linux. This affects the function grace_alarm_handler of the component Signal Handler. The manipulation leads to race condition. This vulnerability is documented as CVE-2024-6387. The attack can be initiated remotely. Additionally, an exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenSSH up to 9.8 on Linux and classified as critical. This issue affects the function grace_alarm_handler of the component Signal Handler. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2024-6387 since 06/27/2024. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known.

The exploit is available at packetstormsecurity.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 209711 (Fortinet FortiWeb (FG-IR-24-258)), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 42046 (OpenSSH Remote Unauthenticated Code Execution Vulnerability (regreSSHion)).

Upgrading to version 9.8p1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 81c1099d22b81ebfd20a334ce986c4f753b0db29 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Exploit-DB (52269), Tenable (209711) and CERT Bund (WID-SEC-2024-1486). blog.qualys.com is providing further details. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Fortinet FortiAuthenticator
• IBM AIX
• Cisco Nexus Dashboard
• Cisco Secure Email Gateway
• Cisco IOS XE
• Debian Linux
• Amazon Linux 2
• FreeBSD Project FreeBSD OS
• Alcatel Lucent Enterprise AOS
• Huawei OceanStor
• Red Hat Enterprise Linux
• Fedora Linux
• NetBSD Foundation NetBSD OS
• Cisco Application Policy Infrastructure Controller
• Cisco Unified Contact Center Express (UCCX)
• Ubuntu Linux
• Cisco Identity Services Engine (ISE)
• Cisco Prime Infrastructure
• SUSE Linux
• Fortinet FortiManager
• Cisco Nexus
• Cisco Router
• Oracle Linux
• Arista EOS
• Cisco Expressway
• Cisco Aironet Access Point
• Cisco Firepower
• QNAP NAS
• Alcatel Lucent Enterprise OmniSwitch
• Cisco Catalyst
• Cisco TelePresence
• Cisco Meeting Server
• IBM SAN Volume Controller
• IBM Storwize
• Fortinet FortiAnalyzer
• Fortinet FortiMail
• Aruba Switch
• NetApp AFF
• NetApp ActiveIQ Unified Manager
• IBM FlashSystem
• Siemens SIMATIC S7
• Cisco Unified Communications Manager (CUCM)
• Cisco Unity Connection
• Cisco Emergency Responder
• WatchGuard Firebox
• IBM Security Guardium
• Huawei iMaster NCE FabricInsight
• Huawei Router
• Dell PowerScale OneFS
• Cisco Secure Web Appliance
• Cisco ASA (Adaptive Security Appliance)
• IGEL OS
• Open Source OpenSSH
• Securepoint UTM
• Cisco FXOS
• Cisco Smart Software Manager On-Prem
• Cisco Wireless Access Point
• HAProxy ALOHA
• HAProxy HAProxy
• Cisco Evolved Programmable Network Manager
• Cisco IP Phone
• OTRS OTRS
• Aruba EdgeConnect
• Aruba ArubaOS
• Alcatel Lucent Enterprise Desk Phone
• Meinberg LANTIME
• Huawei AC6805
• Huawei AirEngine
• Huawei CloudEngine
• Huawei FusionServer Pro
• Huawei iMaster NCE-Campus
• Huawei iMaster NCE-CampusInsight
• Huawei iMaster NCE Fabric
• Huawei NetEngine
• Moxa Router
• IBM DB2
• Dell integrated Dell Remote Access Controller
• Phoenix Contact FL MGUARD
• Fortinet FortiVoice
• Fortinet FortiWeb
• Juniper JUNOS
• HPE HP-UX
• NetApp Data ONTAP
• Dell Avamar
• NetApp FAS

Productinfo

Type

• Connectivity Software

Name

• OpenSSH

Version

• 9.0
• 9.1
• 9.2
• 9.3
• 9.4
• 9.5
• 9.6
• 9.7
• 9.8

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion