Arch Linux Security Advisory ASA-202407-1 ========================================= Severity: High Date : 2024-07-01 CVE-ID : CVE-2024-6387 Package : openssh Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-2855 Summary ======= The package openssh before version 9.8p1-1 is vulnerable to authentication bypass. Resolution ========== Upgrade to 9.8p1-1. # pacman -Syu "openssh>=9.8p1-1" The problem has been fixed upstream in version 9.8p1. Workaround ========== Set LoginGraceTime to 0 in /etc/ssh/sshd_config. This makes sshd vulnerable to a denial of service (the exhaustion of all MaxStartups connections), but it makes it safe from this vulnerability. Description =========== A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). Impact ====== A remote attacker could use this issue to bypass authentication and remotely access systems without proper credentials. During upgrade, the sshd service must be restarted right away using the same connection to avoid being locked out. References ========== https://www.openwall.com/lists/oss-security/2024/07/01/3 https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt https://github.com/openssh/openssh-portable/commit/81c1099d22b81ebfd20a334ce... https://security.archlinux.org/CVE-2024-6387