Summary
This document is an advisory that provides situational awareness regarding a critical unauthenticated remote code execution vulnerability identified in OpenSSH, specifically CVE-2024-6387. This vulnerability affects the server component of OpenSSH on glibc-based Linux systems, allowing attackers to gain full root access without user interaction. The flaw, codenamed regreSSHion, is due to a signal handler race condition and impacts OpenSSH versions 8.5p1 through 9.7p1, as well as earlier versions unless patched for CVE-2006-5051 and CVE-2008-4109. The advisory outlines the conditions under which exploitation occurs, emphasizing the significant security risks posed by this vulnerability. Recommendations include upgrading to OpenSSH version 9.8p1 or later, restricting SSH access, monitoring for potential exploitation attempts, and ensuring that critical systems are backed up and incident response plans are rehearsed. The document also notes that OpenBSD systems are unaffected due to built-in security mechanisms.
