CVE-2024-6387

A security regression (CVE-2006-5051) was discovered in OpenSSH’s server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Mitigation

The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter. However, the sshd server is still vulnerable to a Denial of Service as an attacker could still exhaust all the connections.

1. As root user, open the /etc/ssh/sshd_config

2. Add or edit the parameter configuration:

   LoginGraceTime 0

3. Save and close the file

4. Restart the sshd daemon:

   systemctl restart sshd.service