CYPHERLOCK, INC.

Severe OpenSSH Flaw in FreeBSD Allows Remote Attackers to Obtain Root Access

A significant security flaw has been identified in OpenSSH on FreeBSD systems, potentially enabling unauthorized remote code execution. The flaw, tracked as CVE-2024-7589, impacts all currently supported FreeBSD versions.

The vulnerability arises from an issue in the SSH daemon (sshd), where a signal handler might invoke logging functions that aren’t safe for asynchronous signal handling. This signal handler is activated when a client doesn’t authenticate within the default 120-second LoginGraceTime window. Instead of safely managing the timeout, the handler mistakenly calls a logging function that isn’t suitable for asynchronous execution. This flaw is linked to the integration of FreeBSD’s blacklistd service and creates a race condition that attackers can exploit to run arbitrary code remotely.

This vulnerable code runs with full root privileges within sshd’s privileged context, presenting a race condition that could be exploited by attackers for unauthenticated remote code execution.

FreeBSD has issued patches for this vulnerability in the following releases:

  • 14.1-RELEASE-p3
  • 14.0-RELEASE-p9
  • 13.3-RELEASE-p5

System administrators are urged to update their FreeBSD systems without delay. For those unable to apply the patch immediately, a temporary measure involves setting LoginGraceTime to 0 in the sshd configuration file, though this workaround might expose systems to denial-of-service attacks.

The vulnerability is highly critical, as it enables unauthenticated remote code execution, potentially allowing full system takeover. Exploiting this flaw could give attackers root access, enabling them to install backdoors, steal data, or deploy malware.

The vulnerability is particularly alarming because it occurs within the privileged sshd context, which operates with full root access and is not sandboxed.

This issue bears resemblance to CVE-2024-6387, recently discovered in OpenSSH on Linux, but CVE-2024-7589 is specific to FreeBSD’s OpenSSH and its integration with blacklistd.

This discovery underscores the critical need for regular security audits and timely patching, particularly for essential infrastructure like SSH servers. FreeBSD users should prioritize applying the security patches to protect their systems from potential exploitation.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day