CVE-2024-6387: Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server

[miwithro]

It was discovered that OpenSSH incorrectly handled signal management. A remote attacker could use this issue to bypass authentication and remotely access systems without proper credentials.

https://ubuntu.com/security/CVE-2024-6387

AKS Information

Upgrade your Ubuntu node image to 202407.03.0 which is finalizing the global rollout to all Azure regions around 7/19/2024.

Upgrade your Azure Linux node image to 202407.08.0 which will begin rolling out globally to all Azure regions the week of 7/15/2024.

Windows is not vulnerable to this specific CVE.

[riccalioliojr]

Is there a possible quick workaround to just update openssh on the OS level and restart just the sshd service? Aside from waiting for a while for the new image to be available, updating the image will also require downtime...

[gohmc]

There's a mitigation mentioned here; change LoginGraceTime in /etc/ssh/sshd_config to 0. This is a reasonable (but not perfect) workaround for nodes that do not allow SSH via the Internet.

[MikeWedderburn-Clarke]

I like the following ARG query to see all AKS versions and node versions across all clusters in all subscriptions.
Useful for times like this.

Resources | join kind=inner (     resourcecontainers     | where type == 'microsoft.resources/subscriptions'     | project subscriptionId, subscriptionName = name)     on subscriptionId  | where type == "microsoft.containerservice/managedclusters" | extend kubernetesVersion = properties.currentKubernetesVersion, pool = properties.agentPoolProfiles  | project subscriptionId, subscriptionName, name, kubernetesVersion, pool  | mv-expand pool  | project subscription = subscriptionId, subscriptionName, cluster = name, kubernetesVersion, poolname = pool.name, size = pool.vmSize, count = pool.['count'], pool.nodeImageVersion

[MikeWedderburn-Clarke]

Can also disable SSH on all AKS nodes: https://learn.microsoft.com/en-us/azure/aks/manage-ssh-node-access?tabs=node-shell#disable-ssh-overview

[Egoorbis]

@miwithro do you have any more details on the timeline when the new image will roll out to the regions?

[mehdikops]

it seems 202407.01.0 has been removed! So will there be another image?

[qaiserali]

Any progress on this?

[miwithro]

@riccalioliojr @qaiserali @mehdikops @Egoorbis @gohmc @MikeWedderburn-Clarke we updated the fixed VHD to 202407.03.0 which is now being rolled out to all regions and will be in every region within 3 weeks. If customers need to mitigate now, they should just disable SSH on there cluster too, which was called out above.

[jtencioc101]

@miwithro is this affecting Azure Linux images as well?

[gsingh935]

tried disabling ssh using disable SSH but no luck. One of the ways is to upgrade the openssh library using https://learn.microsoft.com/en-us/azure/aks/node-access#connect-using-kubectl-debug and then running sudo apt update && sudo apt install openssh-server on the node.

[shashankbarsin]

@gurcharan100292 - can you expand on 'tried disabling ssh using disable SSH but no luck'. can you share if you ran into any issues? if yes, repro steps and what issue was observed?

[miwithro]

@gurcharan100292 which region/s are your cluster/s in? You can track the rollout of 202407.03.0 which has the fix https://releases.aks.azure.com/webpage/index.html#tabversion

[miwithro]

202407.03.0 has been deployed to all Azure regions.

[riccalioliojr]

@gurcharan100292 which region/s are your cluster/s in? You can track the rollout of 202407.03.0 which has the fix https://releases.aks.azure.com/webpage/index.html#tabversion

The website seems to have a problem. The latest I can see is v20240627 in all regions. (Except West US 2 which has v20240609 instead.) I tried opening it in an incognito/private window and I can see the same.

[gsingh935]

shashankbarsin miwithro even after disabling the ssh on AKS nodes, the vulnerability still exists. I think the 202407.03.0 version is out now so will try updating the nodes now.

[mehdikops]

202407.03.0 has fixed the vulnerability for us, thank you!

[MikeWedderburn-Clarke]

shashankbarsin miwithro even after disabling the ssh on AKS nodes, the vulnerability still exists. I think the 202407.03.0 version is out now so will try updating the nodes now.

Thanks for the info. I'm not sure how you're testing for the vulnerability, but it's important to note that the vuln is IN SSH. So, once you disable SSH on the node, it is no longer susceptible to being exploited.

[AlftioH]

Ubuntu Fix has been applied to AKS images.

SSH Fixed file names

openssh-client/jammy-updates,jammy-security,now 1:8.9p1-3ubuntu0.10 amd64 [installed,automatic]
openssh-server/jammy-updates,jammy-security,now 1:8.9p1-3ubuntu0.10 amd64 [installed]
openssh-sftp-server/jammy-updates,jammy-security,now 1:8.9p1-3ubuntu0.10 amd64 [installed]

Fix is present on:
https://ubuntu.com/security/CVE-2024-6387

UBUNTU Changelog
https://changelogs.ubuntu.com/changelogs/pool/main/o/openssh/openssh_8.9p1-3ubuntu0.10/changelog

AKS IMAGES INCLUDING THE UBUNTU FIX
202407.08.0
https://github.com/Azure/AKS/blob/2024-07-16/vhd-notes/aks-ubuntu/AKSUbuntu-2204/202407.08.0.txt

202407.03.0
https://raw.githubusercontent.com/Azure/AgentBaker/master/vhdbuilder/release-notes/AKSUbuntu/gen1/2204containerd/202407.03.0.txt

To grant the nodes are using an image containing the fix update to the latest available node image version
https://learn.microsoft.com/en-us/azure/aks/node-image-upgrade

Additional References
https://ubuntu.com/security/cves?q=&package=openssh

https://packages.ubuntu.com/search?suite=all&section=all&arch=any&searchon=sourcenames&keywords=openssh&_ga=2.203255767.794321282.1722361005-960638896.1722361005&_gl=1*sha571*_gcl_au*MjE0MjAxMTg2OC4xNzIyMzYxMTAz