Vulnerability in OpenSSH FreeBSD Let Hackers Gain Root Access Remotely

A critical security vulnerability has been identified in OpenSSH, affecting all supported versions of FreeBSD. The flaw, tracked as CVE-2024-7589, involves a pre-authentication async signal safety issue that could potentially allow unauthenticated remote code execution as root.

OpenSSH, a widely used implementation of the SSH protocol suite, is vulnerable in its sshd(8) daemon.

A signal handler may invoke a logging function that is not async-signal-safe when a client fails to authenticate within the default LoginGraceTime of 120 seconds.

This issue arises from the integration of blacklistd OpenSSH on FreeBSD and is related to a previously addressed vulnerability (CVE-2024-6387)

FreeBSD in OpenSSH refers to one of the primary Unix-like operating systems on which OpenSSH is developed and widely used.

It provides a stable, secure environment that complements OpenSSH’s secure networking capabilities, making it a popular choice for implementing secure remote access and communications.

The vulnerability (CVE-2024-7589) presents a race condition that attackers could exploit to execute remote code with root privileges. This poses a significant security risk to systems running affected versions of FreeBSD.

The OpenSSH release report states, “A signal handler in sshd(8) may call a logging function that is not async- signal-safe.

The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)’s privileged code, which is not sandboxed and runs with full root privileges.”

Mitigation

As an immediate workaround, administrators can set LoginGraceTime to 0 in /etc/ssh/sshd_config and restart sshd(8). While this mitigates the risk of remote code execution, it may lead to a denial of service by exhausting all MaxStartups connections.

FreeBSD users are urged to update their systems to a version released after the correction dates:

• Stable/14: August 6, 2024
• Releng/14.1: August 7, 2024
• Releng/14.0: August 7, 2024
• Stable/13: August 6, 2024
• Releng/13.3: August 7, 2024

Update Instructions

1. Binary Patch:

• Systems on amd64, arm64, or i386 (FreeBSD 13) can use freebsd-update:
  sh # freebsd-update fetch # freebsd-update install

1. Source Code Patch:

• Download and verify the patch:
  sh # fetch https://security.FreeBSD.org/patches/SA-24:08/openssh.patch # fetch https://security.FreeBSD.org/patches/SA-24:08/openssh.patch.asc # gpg --verify openssh.patch.asc
• Apply the patch and rebuild:
  sh # cd /usr/src # patch < /path/to/patch # make buildworld # make installworld
• Restart the affected services or reboot the system.

Download Free Cybersecurity Planning Checklist for SME Leaders (PDF) – Free Download