This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] OpenSSH fixes 2 vulnerabilities

OpenSSH fixes two vulnerabilities with version 9.8. The vulnerability CVE-2024-6387 was introduced into the product in version 8.5p1 and the vulnerability CVE-2024-39894 in version 9.5. Among operating systems, the first-mentioned vulnerability has so far been fixed by Debian [1], Ubuntu [2], Slackware [3]. Red Hat (affects only Red Hat Enterprise Linux 9) [4], Gentoo has released a testing version 9.8_p1-r2 [6] and OpenBSD is not vulnerable at all [5]. The second-mentioned vulnerability does not affect the most popular stable releases of operating systems. Operating system releases and fixed OpenSSH versions: Debian [1]: bookworm (security) - 1:9.2p1-2+deb12u3 Ubuntu [2]: jammy - 1:8.9p1-3ubuntu0.10 mantic - 1:9.3p1-1ubuntu3.6 noble - 1:9.6p1-3ubuntu13.3 Slackware [3]: openssh-9.8p1-i586-1_slack15.0 openssh-9.8p1-x86_64-1_slack15.0 openssh-9.8p1-i586-1 openssh-9.8p1-x86_64-1

OpenSSH - RCE (CVE-2024-6387)
CVSS 8.1 (High)

An unauthenticated remote attacker is allowed, by exploiting a race condition bug, to execute arbitrary code with root privileges without authorization. The vulnerability is easier to exploit if the system does not use ASLR (Address space layout randomization), or if ASLR is reused for each connection. The exploitability of the vulnerability was verified under laboratory conditions, where a successful attack was preceded by 6 - 8 hours of creating a large number of new connections to a vulnerable machine with a 32-bit system; in any case, the resulting time of a successful attack depends on the specific type of system and the nature of the network. Systems that use the glibc library are certainly vulnerable, but the vulnerability of systems that use an analogue of this library cannot be ruled out at present either [5][7]. The likelihood of exploitation can be significantly reduced by using properly configured protective software, such as fail2ban, which can reduce the number of login attempts in a given time [8]. A detailed analysis of the vulnerability can be found at [7]. As a temporary fix, OpenSSH logs can be redirected to standard error output "stderr" by running OpenSSH with the command "sshd -e", which excludes the use of syslog, whose use in OpenSSH caused this vulnerability (verified on Debian and Fedora) [9][10].

The vulnerability is present in product:

  • OpenSSH; >=8.5p1, <9.8;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 1. 7. 2024. This report was last updated 8. 7. 2024.

OpenSSH - timing attack (CVE-2024-39894)
CVSS 7.5 (High)

An attacker in the position of a passive observer of an SSH session is allowed to obtain certain information about the user's password by means of a timing attack carried out while the password is being entered in "echo-off" mode. The vulnerability is exploitable only if "ObscureKeystrokeTiming" was enabled or if a TTY request was sent [5].

The vulnerability is present in product:

  • OpenSSH; >=9.5,<9.8;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 1. 7. 2024.

By CESNET, z.s.p.o. Martin Krajči on 1. 7. 2024.

CESNET, z.s.p.o. Logo