🔴 Critical | Source: GCP Compute Engine Security Bulletins
A critical remote code execution vulnerability (CVE-2024-6387, also known as ‘regreSSHion’) has been discovered in OpenSSH, allowing an unauthenticated attacker to execute arbitrary code as root. All GCP Compute Engine VMs running glibc-based Linux distributions with OpenSSH exposed to the network are potentially affected. Google has issued patched versions for Container-Optimized OS and TPU images, with broader Linux distribution patches also available.
Security Architect’s Take: Audit your Compute Engine fleet immediately for exposed OpenSSH services on glibc-based Linux instances, and apply vendor patches as a priority — particularly updating Container-Optimized OS to the specified patched builds and TPU images if applicable. Consider restricting SSH access via firewall rules or IAP tunnelling as an interim control where patching cannot be done immediately.
Original advisory: GCP-2024-040