New OpenSSH Vulnerability CVE-2024-6409 Exposes Systems to Remote Code Execution Risks

by | Jul 10, 2024 | News

Post Views: 1,116

Join our Patreon Channel and Gain access to 70+ Exclusive Walkthrough Videos.

Reading Time: 3 Minutes

Discovery of CVE-2024-6409

Security researchers have identified a new vulnerability in OpenSSH, tagged as CVE-2024-6409, that poses a serious risk of remote code execution (RCE) on affected systems. This critical flaw affects OpenSSH versions 8.7 and 8.8 due to a race condition in signal handling within the privilege separation (privsep) child process.

Affected Versions and Specifics

The vulnerability impacts OpenSSH versions 8.7 and 8.8, including their portable releases. A significant concern arises from certain downstream patches, such as Red Hat’s openssh-7.6p1-audit.patch, which adds additional code to cleanup_exit() and exacerbates the vulnerability. Unlike CVE-2024-6387, this race condition is triggered within the privsep child process, which operates with reduced privileges, slightly mitigating the immediate impact but still posing a substantial threat.

See Also: So, you want to be a hacker?
Offensive Security, Bug Bounty Courses

Discover your weakest link. Be proactive, not reactive. Cybercriminals need just one flaw to strike.

Implications of the Vulnerability

Despite the reduced privileges of the privsep child process, the potential for remote code execution remains a severe risk. The privsep child process is intended to limit the damage in case of a compromise, but the ability to exploit this vulnerability for RCE could lead to significant security breaches.

Mitigation and Patching

Apply Patches: Immediate patching of affected systems is crucial. Various distributions, like Rocky Linux, have already released patches to address this vulnerability.

Configuration Adjustments: Implement security measures such as setting LoginGraceTime to 0 to prevent exploitation of this and similar vulnerabilities.

Monitoring and Alerts: Enhance monitoring for unusual activity, particularly related to authentication attempts and signal handling within the SSH daemon.

Comparative Vulnerabilities

This disclosure follows another critical OpenSSH vulnerability, CVE-2024-6387, known as “RegreSSHion,” which was disclosed on July 1, 2024. CVE-2024-6387 also involves a signal handler race condition, leading to unauthenticated RCE with root privileges on glibc-based Linux systems.

For detailed information on the vulnerability and available patches, refer to the official security advisories and updates from your software vendors.

Are u a security researcher? Or a company that writes articles about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing? If you want to express your idea in an article contact us here for a quote: [email protected]

Source: cybersecuritynews.com

Source Link