RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#1

Post by robinhoodexe » Mon, Jul 01, 2024, 8:40 AM UTC

RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems
qualys.com

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#2

Post by megous » Mon, Jul 01, 2024, 8:56 AM UTC

    In our experiments, it takes ~10,000 tries on average to win this race
    condition, so ~3-4 hours with 100 connections (MaxStartups) accepted
    per 120 seconds (LoginGraceTime). Ultimately, it takes ~6-8 hours on
    average to obtain a remote root shell, because we can only guess the
    glibc's address correctly half of the time (because of ASLR).

MaxStartups default is 10

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#3

Post by djmdjm » Mon, Jul 01, 2024, 8:56 AM UTC

OpenSSH release notes: https://www.openssh.com/txt/release-9.8

Minimal patches for those can't/don't want to upgrade: https://marc.info/?l=oss-security&m=171982317624594&w=2

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#4

Post by 0x0 » Mon, Jul 01, 2024, 9:06 AM UTC

Patch out for Debian 12; Debian 11 not affected.

https://security-tracker.debian.org/tracker/CVE-2024-6387

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#5

Post by nubinetwork » Mon, Jul 01, 2024, 9:06 AM UTC

I haven't seen an increase of ssh traffic yet, but the alert only went out a couple hours ago... hopefully distros will ship the patches quickly.

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#6

Post by Haemm0r » Mon, Jul 01, 2024, 9:07 AM UTC

megous wrote: post #2

In our experiments, it takes ~10,000 tries on average to win this race condition, so ~3-4 hours with 100 connections (MaxStartups) accepted per 120 seconds (LoginGraceTime). Ultimately, it takes ~6-8 hours on average to obtain a remote root shell, because we can only guess the glibc's address correctly half of the time (because of ASLR). MaxStartups default is 10

Question regarding this from a non-guru: - Is it correct that this only works for user root if login with password/key for root is allowed? - Is it correct, that this only works if the attacker knows a login name valid for ssh?

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#7

Post by morsch » Mon, Jul 01, 2024, 9:07 AM UTC

djmdjm wrote: post #3

OpenSSH release notes: https://www.openssh.com/txt/release-9.8 Minimal patches for those can't/don't want to upgrade: https://marc.info/?l=oss-security&m=171982317624594&w=2

> Exploitation on 64-bit systems is believed to be possible but has not been demonstrated at this time.

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#8

Post by cperciva » Mon, Jul 01, 2024, 9:12 AM UTC

Patch out for FreeBSD. Not clear if affected (it has only known to be exploitable with glibc, which we don't use) but best to be safe.

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04...

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#9

Post by booi » Mon, Jul 01, 2024, 9:12 AM UTC

nubinetwork wrote: post #5

I haven't seen an increase of ssh traffic yet, but the alert only went out a couple hours ago... hopefully distros will ship the patches quickly.

i would assume all the distros have patches ready to go awaiting the embargo lift.

Re: RegreSSHion: RCE in OpenSSH's server, on glibc-based Linux systems

#10

Post by cperciva » Mon, Jul 01, 2024, 9:15 AM UTC

nubinetwork wrote: post #5

I haven't seen an increase of ssh traffic yet, but the alert only went out a couple hours ago... hopefully distros will ship the patches quickly.

This is the sort of bug which pre-announcement coordination is designed for. Anyone who doesn't have patches ready was either forgotten (I've seen a few instances of "I thought you were going to tell them!") or isn't on the ball.