GCP-2024-040

<strong>Published:</strong><br/><strong>Updated:</strong><br/><table class="fixed"> <thead> <tr> <th width="70%">Description</th> <th>Severity</th> <th>Notes</th> </tr> </thead> <tbody> <tr> <td><strong>Updated: 2024-08-20</strong></td> <td><strong>Critical</strong></td> <td><strong>CVE-2024-6387</strong></td> </tr> <td> <p><strong>2024-08-20: Include patches for TPUs.</strong> Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. If you are using TPUs, please update to one of the following patched versions:</p> <ul> <li>tpu-ubuntu2204-base</li> <li>v2-alpha-tpuv5</li> <li>v2-alpha-tpuv5-lite</li> </ul> <p>A vulnerability (CVE-2024-6387) has been discovered in OpenSSH. Successful exploitation of this vulnerability allows a remote, unauthenticated attacker to execute arbitrary code as root on the target machine. <br/><br/> All Compute Engine VMs that use a glibc-based Linux distribution and have OpenSSH exposed are recommended to be analyzed for the vulnerable versions. </p> <h4 data-text="What should I do?" id="what-should-i-do_13" tabindex="-1">What should I do?</h4> <ol> <li>Apply updates from Linux distributions as they become available. Please refer to guidance from Linux distributions. For Google's Container-Optimized OS, please update to one of the following patched versions: <ul> <li>cos-113-18244-85-49</li> <li>cos-109-17800-218-69</li> <li>cos-105-17412-370-67</li> <li>cos-101-17162-463-55</li> </ul> If you are using Container-Optimized OS through a Google managed service (e.g. GKE), please refer to that service's security bulletin for patch availability. </li> <li>If updating is not possible, consider turning OpenSSH off until it can be patched. The default network is pre-populated with a <code dir="ltr" translate="no">default-allow-ssh</code> firewall rule to allow ssh access from the public Internet. To remove this access, customers can: <ol> <li>Optionally <a href="https://docs.cloud.google.com/firewall/docs/using-firewalls#creating_firewall_rules">create rules</a> to allow any SSH access you need from trusted networks to GKE nodes or other Compute Engine VMs in the project; then</li> <li>Disable the default firewall rule with the following command: <div></div><devsite-code><pre dir="ltr" is-upgraded="" translate="no">gcloud compute firewall-rules update default-allow-ssh --disabled --project=$PROJECT </pre></devsite-code></li> </ol> If you have created any other firewall rules that may allow SSH through TCP on port 22, disable them, or limit the source IPs to trusted networks. <br/><br/> Verify that you can no longer ssh to your VMs from the Internet. This firewall configuration mitigates the vulnerability. </li> <li>If OpenSSH needs to be left on, you can also execute a configuration update which eliminates the race case condition for the exploit. This is a runtime mitigation. To apply the changes in the sshd config, this script will restart the sshd service. <div></div><devsite-code><pre dir="ltr" is-upgraded="" translate="no"> #!/bin/bash set -e SSHD_CONFIG_FILE=/etc/ssh/sshd_config # -c: count the matches # -q: don't print to console # -i: sshd_config keywords are case insensitive. if [[ "$(grep -ci '^LoginGraceTime' $SSHD_CONFIG_FILE)" -eq 0 ]]; then echo "LoginGraceTime 0" &gt;&gt; "$SSHD_CONFIG_FILE" echo "Set the LoginGraceTime to 0 in $SSHD_CONFIG_FILE" else sed -i 's/^LoginGraceTime.*$/LoginGraceTime 0/' /etc/ssh/sshd_config echo "Changed the LoginGraceTime to 0 in $SSHD_CONFIG_FILE" fi # Restart the sshd service to apply the new config. systemctl restart sshd </pre></devsite-code></li> <li>Finally, monitor for any unusual network activity involving SSH servers. </li> </ol> </td> <td> Critical </td> <td> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387">CVE-2024-6387</a> </td> </tbody> </table>