doux-x/cve-2024-6387-analysisCVE-2024-6387 OpenSSH 信号竞争漏洞（regreSSHion）分析报告及检测脚本
CVE-2024-6387 is a signal handling race condition vulnerability in OpenSSH versions 8.5p1 through 9.7p1, known as "regreSSHion". An attacker can continuously attempt within 6-8 hours to execute arbitrary code with root privileges, affecting approximately 14 million servers worldwide.
OpenSSH 8.5p1 ~ 9.7p1 (Ubuntu 22.04 default version 8.9p1 is affected)
Operating System: Ubuntu 22.04.5 LTS
OpenSSH Version: 8.9p1
Target Address: 127.0.0.1:22
#!/bin/bash
# check_cve_2024_6387.sh
TARGET=${1:-127.0.0.1}
PORT=22
echo "[*] CVE-2024-6387 漏洞检测"
echo "[*] 目标: $TARGET:$PORT"
for i in {1..1000}; do
timeout 1 nc -zv $TARGET $PORT 2>/dev/null
if [ $((i % 100)) -eq 0 ]; then
echo "[*] 已完成 $i 次连接"
fi
done
echo "[+] 检测完成"
echo "[*] 请检查系统日志: sudo tail -20 /var/log/auth.log"
[] CVE-2024-6387 OpenSSH Vulnerability Detection
[] Target: 127.0.0.1:22
[] Completed 100 connections
[] Completed 200 connections ... [] Completed 1000 connections
[+] Detection completed, took 5 seconds
Upgrade OpenSSH:
sudo apt update
sudo apt upgrade openssh-server
Verify version: ssh -V (should show 9.7p1 or above)
Emergency measures: Limit connection frequency
iptables -A INPUT -p tcp --dport 22 -m limit --limit 1/minute -j ACCEPT
Install fail2ban:
sudo apt install fail2ban
sudo systemctl enable fail2ban
README.md
CVE-2024-6387-analysis.md
check_cve_2024_6387.sh
NVD - CVE-2024-6387
Qualys Security Advisory
Doux-x