Critical OpenSSH RCE Vulnerability Allows Root Access on Linux Servers

Tech & AI | July 1, 2024, 2:14 p.m.

A serious vulnerability in OpenSSH, dubbed "regreSSHion," allows unauthenticated remote attackers to exploit a signal handler race condition in sshd to execute arbitrary code as root on glibc-based Linux systems. This flaw, designated as CVE-2024-6387, was discovered by Qualys researchers in May 2024 and poses a significant threat to affected servers by potentially enabling complete system compromise. While the exploitation process is challenging, Qualys warns that AI tools could be used to overcome these difficulties. Mitigation strategies include applying the latest updates, restricting SSH access, and implementing network controls. OpenBSD systems are not affected, and the vulnerability is primarily seen in Linux systems with specific OpenSSH versions. An analysis is required to determine the vulnerability on macOS and Windows systems. Scans show millions of internet-exposed OpenSSH servers, with a confirmed vulnerable status for 700,000 instances.