regreSSHion - race condition in SSH allows RCE/DoS
CVE: CVE-2024-6387
Component: openssh
CWE: CWE-364
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2024-07-01T08:00:00+00:00

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Statement: Red Hat rates the severity of this flaw as Important for both Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform (OCP). The most significant risk is Remote Code Execution, however this outcome requires significant resources to exploit. If mitigations are put in place, the consequences of exploitation are reduced. An attacker would then only be able to impact availability of the OpenSSH service.

The main factor preventing a higher impact rating is an unpredictable race condition. All actively supported versions of RHEL (and by extension OCP) have ExecShield (aka ASLR) enabled by default and utilize NX technology, reducing reliability of the attack. Attackers are forced to retry the attack thousands of times. This generates significant noise providing defenders with an opportunity to detect and disrupt potential attacks.

RHEL 9 is the only affected version. RHEL 6, 7, and 8 all utilize an older version of OpenSSH which was never affected by this vulnerability.

The affected versions of OCP are 4.13, 4.14, 4.15, and 4.16 as they include the affected version of OpenSSH in the underlying operating system Red Hat CoreOS (RHCOS). 4.12 and earlier versions of OCP are not affected.

Remediation:
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:c7e3658ca8f0f1fc8ce1512ecc36785a68b1388dfbfc39642bff8120bfa86a33

      (For s390x architecture)
      The image digest is sha256:71641ec665a81c7228ac2254ae30899ee68bef872653c807dc34dede0cfe91b8

      (For ppc64le architecture)
      The image digest is sha256:a71a1339e4304715cb0957a5db2777fd6e626420ba252af8b47445bcbfaac655

      (For aarch64 architecture)
      The image digest is sha256:4f08ad2deadb6731ebd82ae924c47d06c0c162bb57914e1f287f9c0c68e9838a

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:40ba8c540d16a97a6b629232a5a16da64fca655c4b83b734aa28415b5c708acf

      (For s390x architecture)
      The image digest is sha256:41509f7d89cfb28d88acc7264e5f63dc929fe15ad4c74a59ce97f92761c15f43

      (For ppc64le architecture)
      The image digest is sha256:f572ab3c129f1440e4fc5d9996011d99d2160b46c1b8f814529fe92aa520f2e4

      (For aarch64 architecture)
      The image digest is sha256:9b6f80b92822336eff876161cafef17100c240da1c1302c84d3816aeae255641

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:f0787207e687538a2d1248f2956b5bd26e304334eeb2f6474833040063377e9a

      (For s390x architecture)
      The image digest is sha256:483f95c386a24778ea807286fac3a1b702787893a265305dfd6af13f0cf85645

      (For ppc64le architecture)
      The image digest is sha256:27b5b20aa2f76345c7fedc4cea350a3fa37f055472a260d7c971a1bb62dbd2b0

      (For aarch64 architecture)
      The image digest is sha256:b24c0158d257fdf06277d68656c29c8ec3abdea2905801a721f606a024568c8f

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:3ec3a43ded1decc18134e5677f56037d8929f4442930f5d1156e7a77cdf1b9b3

      (For s390x architecture)
      The image digest is sha256:9b9bebfa88de4b930fdc0bbbe1b30baf35e6d732bd273977c6c46ac825ddc629

      (For ppc64le architecture)
      The image digest is sha256:61d47638d63f8ba8bca42b12dfafb7bd8aa9fcb2d7e39d0ccf87f5e571a560db

      (For aarch64 architecture)
      The image digest is sha256:c33c0068a3cec747bcbac401a5fbcd6c9611f34e624b640da4378d40d8a48a89

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections.

1) As root user, open the /etc/ssh/sshd_config
2) Add or edit the parameter configuration:
~~~
LoginGraceTime 0
~~~
3) Save and close the file
4) Restart the sshd daemon:
~~~
systemctl restart sshd.service
~~~

Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately.

If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed.