# MA-1090.072024: MyCERT Advisory - Critical RCE Vulnerability in OpenSSH Linux systems

**Date:** 04 Jul 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1090.072024  
**Advisory ID:** MA-1090.072024

---

**1.0 Introduction**
A new OpenSSH unauthenticated remote code execution (RCE) vulnerability dubbed regreSSHion was reported, affecting glibc-based Linux systems. This vulnerability, identified as CVE-2024-6387, allows remote attackers to execute arbitrary code as root due to a signal handlers race condition in sshd.
**2.0 Impact**
An exploited vulnerability could lead to full compromise where an attacker can execute arbitrary code with the highest privileges, resulting in a complete system takeover, installation of malware, data manipulation, and the creation of backdoors for persistent access. It could facilitate network propagation, allowing attackers to use a compromised system as foothold to traverse and exploit other vulnerable system within the organization.
**3.0  Affected Products**
- OpenSSH versions earlier than 4.4p1 (if not patched for CVE-2006-5051 and CVE-2008-4109).
- OpenSSH 8.5p1 up to, but not including, 9.8p1
**4.0 Recommendation**
CyberSecurity Malaysia highly recommends that users of these applications upgrade to the latest version of the affected products. The following updates are available:
- Apply all OpenSSH patches: <https://www.openssh.com/security.html>
- Lock down access control: Limit SSH access via tcp/22 through network-based controls to minimize attack risk.
- Apply segmentation: Divide network to restrict unauthorized access to the OpenSSH server.
- Set the LoginGraceTime to 0 in the sshd configuration file.
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://www.bleepingcomputer.com/news/security/new-regresshion-openssh-rce-bug-gives-root-on-linux-servers/>
- <https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server>
- <https://ubuntu.com/security/CVE-2024-6387>
- <https://security-tracker.debian.org/tracker/CVE-2024-6387>
- <https://access.redhat.com/security/cve/cve-2024-6387>
- <https://cert.europa.eu/publications/security-advisories/2024-066/>
- <https://medium.com/@wartelski/critical-vulnerability-in-openssh-discovered-a0909ea45fde>
- <https://orca.security/resources/blog/detect-and-mitigate-cve-2024-6387/>