RegreSSHion

{{Infobox bug

| name = RegreSSHion (security bug)

| image =

| caption =

| CVE = {{CVE|2024-6387}}

| patched = {{Start date and age|2024|7|1|df=yes}}

| discoverer = Qualys Threat Research Unit (TRU)

| affected software = OpenSSH (8.5p1–9.7p1)

| website =

}}

RegreSSHion is a family of security bugs in the OpenSSH software that allows for an attacker to remotely execute code and gain potential root access on a machine running the OpenSSH Server.{{cite web | url=https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server | title=RegreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server | date=July 2024 }}

{{cite web | url=https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ | title="RegreSSHion" vulnerability in OpenSSH gives attackers root on Linux | date=2 July 2024 }} The vulnerability was discovered by the Qualys Threat Research Unit and was disclosed on July 1, 2024. It affected all prior versions of OpenSSH from 8.5p1 (March 3, 2021) to 9.7p1 (March 11, 2024) and was patched in release 9.8/9.8p1 on July 1, 2024.{{cite web |title=OpenSSH Release Notes |url=https://www.openssh.com/releasenotes.html |website=OpenSSH |access-date=16 July 2024}} Qualys reported identifying over 14 million public facing OpenSSH instances potentially vulnerable to the attack.

{{cite web |title=regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server |url=https://www.qualys.com/regresshion-cve-2024-6387/ |website=Qualys Community |publisher=Qualys |access-date=16 July 2024}} It affects glibc-based Linux systems; Windows and OpenBSD systems are not vulnerable to the attack.

Disclosure

The vulnerability was publicly disclosed by Qualys on July 1, 2024. Qualys reported disclosing the vulnerability to the OpenSSH developers on May 19, approximately two months prior, and reported notifying OpenWall on June 20, 2024.{{cite web |title=Qualys Technical Details |url=https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt |website=Qualys |access-date=16 July 2024}}

Vulnerability

File:Resultant.png

The regreSSHion vulnerability in OpenSSH results from a signal handler race condition in its server component (sshd). This issue is triggered when a client fails to authenticate within the LoginGraceTime period (default 120 seconds). When this timeout occurs, sshd's SIGALRM handler is called asynchronously, invoking functions that are not safe to use in signal handlers, such as syslog(). In versions < 4.4p1, an attacker could exploit the free() function during syslog() within the signal handler. However, in versions from 8.5p1 to 9.7p1, both the free() and malloc() functions are targeted.

This vulnerability is a regression of CVE-2006-5051, reintroduced in OpenSSH 8.5p1 (October 2020) due to the accidental removal of a crucial directive that had mitigated the earlier vulnerability. The directive transformed unsafe calls into a safe _exit(1) call.

Affected versions

Note: The following versions are referring to the upstream versions. Checking the versions shipped by e.g. linux Distros is not enough to validate it being vulnerable or not as many have backported fixes to older versions. E.g. Debian's OpensSSH version 9.7p1-7{{Cite web |title=Package: openssh {{!}} Debian Sources |url=https://sources.debian.org/patches/openssh/1:9.7p1-7/sshsigdie-async-signal-unsafe.patch/ |access-date=2024-07-26 |website=sources.debian.org}} and Rocky Linux's OpenSSH version 8.7p1-38.4{{Cite web |date=2024-07-10 |title=import openssh-8.7p1-38.el9_4.4 (ebf2263f) · Commits · staging / rpms / openssh · GitLab |url=https://git.rockylinux.org/staging/rpms/openssh/-/commit/ebf2263fdd7a5dcce33f27cdebc9d0af5070a1fe |access-date=2024-07-26 |website=GitLab |language=en}} are also NOT Vulnerable.

class="wikitable"

! style="" | Legend:

| style="background-color:#FFCCCC;" | Vulnerable

| style="background-color:#CCFFCC;" | Not Vulnerable

class="wikitable" \|+ ! style="" \| Release !! Status !! Date
style="background-color:#FFCCCC;" \| < 4.4p1	Vulnerable if not patched against CVE-2006-5051 or CVE-2008-4109	Before Sep. 27th, 2006
style="background-color:#CCFFCC;" \| 4.4p1 ≤ OpenSSH < 8.5p1	Not vulnerable due to presence of mitigation directive	Sep. 27th, 2006 - Mar. 3rd, 2021
style="background-color:#FFCCCC;" \| 8.5p1 ≤ OpenSSH < 9.8p1	Vulnerable again because the directive was removed	Mar. 3rd, 2021 - Jul. 1st, 2024
style="background-color:#CCFFCC;" \| ≥ 9.8p1	Patched officially	After Jul. 1st, 2024

Terminology

According to Qualys, the bug was named "regreSSHion" as a reference to a regression bug affecting OpenSSH.

References

Category:Software bugs