# Security advisory: OpenSSH CVE-2024-6387 “regreSSHion” – update your servers ASAP
**URL:** https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220
**Category:** Security
**Created:** [July 1, 2024, 12:12pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220 "2024-07-01T12:12:58Z")
**Posts on this page:** 18
**Page:** 2
### Author:  [@chrism](https://discourse.nixos.org/u/chrism)
#### Post date: [July 3, 2024, 4:52pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/22 "2024-07-03T16:52:31Z")
RIght, sorry, I only read the last status message.
---
### Author:  [@neil.mayhew](https://discourse.nixos.org/u/neil.mayhew)
#### Post date: [July 4, 2024, 8:18pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/24 "2024-07-04T20:18:47Z")
Here’s some nix-fu for checking whether you have the backported patch:
```auto
nix derivation show $(which ssh) | jq -r '.[].inputSrcs[]' | grep CVE-2024
```
---
### Author:  [@emily](https://discourse.nixos.org/u/emily)
#### Post date: [July 4, 2024, 8:35pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/25 "2024-07-04T20:35:20Z")
I believe you need `$(readlink -f $(which ssh))`, otherwise it’ll be looking at the derivation that produced your `/run/current-system/sw/bin`, rather than the OpenSSH one. (So don’t panic if this seems to indicate you’re still vulnerable.)
---
### Author:  [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [July 6, 2024, 4:28pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/26 "2024-07-06T16:28:46Z")
Can we determine if a nixos machine is patched with a tool like vulnix?
---
### Author:  [@tgerbet](https://discourse.nixos.org/u/tgerbet)
#### Post date: [July 6, 2024, 5:01pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/27 "2024-07-06T17:01:29Z")
Yes, `vulnix -R $(readlink -f $(which ssh))` will show you if there is an active advisory on it or not. Under the hood, it does something similar to what the `nix derivation show`/`jq`/`grep` proposed a few posts ago does.
---
### Author:  [@TLATER](https://discourse.nixos.org/u/TLATER)
#### Post date: [July 6, 2024, 6:23pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/28 "2024-07-06T18:23:57Z")
It’s worth noting that all these snippets rely on the contents of `$PATH`, which may or may not match up with whatever is running in the systemd service, especially if user channels or other heavier customization is involved. It’ll work most of the time, of course, but it might not, which is a bit scary. I can’t think of a simple, foolproof and generic check either, though.
Maybe we could make this easier upstream? What do other distros do? “Sadly” this CVE takes too long to exploit to write a simple distro-independent vulnerability checker for it.
---
### Author:  [@bbigras](https://discourse.nixos.org/u/bbigras)
#### Post date: [July 6, 2024, 8:59pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/29 "2024-07-06T20:59:47Z")
Would `vulnix -S` help with that? Not sure if we can filter to only get openssh result? Otherwise, I guess it would take a while to scan everything.
---
### Author:  [@vcunat](https://discourse.nixos.org/u/vcunat)
#### Post date: [July 7, 2024, 6:14am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/30 "2024-07-07T06:14:49Z")
Not 100% foolproof and generic, but I was doing this to see which sshd are running at the moment:
```bash
for p in $(pidof sshd); do readlink /proc/$p/exe; done | sort | uniq -c
```
Note in particular that switching the systemd service won’t immediately replace all of them. Thankfully, as for servers you’re probably doing the update over ssh.
---
### Author:  [@Tmplt](https://discourse.nixos.org/u/Tmplt)
#### Post date: [July 8, 2024, 7:41am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/31 "2024-07-08T07:41:35Z")
> [@emily](#):
>
> Maybe we should have tweaked the derivation name or something so it’s easy to tell if you have the fix.
This would have been appreciated, as none of the snippets in this thread works for me (`error: '/nix/store/ik1hrivpiw5lkmarlzmpk8armfgpxwcf-openssh-9.7p1' does not have a known deriver`).
A quick `systemctl status sshd` check would be ideal, but it doesn’t scale with either CVEs or time: the name tweak must be removed some time (when the patch doesn’t have to be applied in nixpgks?)
---
### Author:  [@emily](https://discourse.nixos.org/u/emily)
#### Post date: [July 8, 2024, 8:34am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/32 "2024-07-08T08:34:23Z")
I take it `vulnix -R $(readlink -f $(which ssh))` doesn’t work for you either? I’m not sure what circumstances would cause this.
---
### Author:  [@Tmplt](https://discourse.nixos.org/u/Tmplt)
#### Post date: [July 8, 2024, 8:51am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/33 "2024-07-08T08:51:08Z")
vulnix fails with the same error, yes.
---
### Author:  [@emily](https://discourse.nixos.org/u/emily)
#### Post date: [July 8, 2024, 10:23am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/34 "2024-07-08T10:23:26Z")
Thanks. I’m curious if you know any details of your setup that might be unusual – Nix settings, Nixpkgs pins, substituters, overlays, …?
---
### Author:  [@tgerbet](https://discourse.nixos.org/u/tgerbet)
#### Post date: [July 8, 2024, 5:45pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/35 "2024-07-08T17:45:18Z")
The most likely reasons for this to occur is that the machine configuration is built over another machine then pushed to it.
There is no derivation to show and scan because the derivation exists only on the machine having built the config.
---
### Author:  [@Tmplt](https://discourse.nixos.org/u/Tmplt)
#### Post date: [July 9, 2024, 12:57pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/36 "2024-07-09T12:57:42Z")
I did just refactor my whole infra into proper flake modules on 24.05, substituters and overlays included. I’ll put an MWE on the agenda and file an issue if I find anything.
---
### Author:  [@Tmplt](https://discourse.nixos.org/u/Tmplt)
#### Post date: [July 10, 2024, 3:46am UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/37 "2024-07-10T03:46:13Z")
It is indeed on a remote server.
---
### Author:  [@liviu](https://discourse.nixos.org/u/liviu)
#### Post date: [July 13, 2024, 1:45pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/38 "2024-07-13T13:45:28Z")
> [@emily](#):
>
> `vulnix -R $(readlink -f $(which ssh))`
Hello, I apologise if i am asking a potentially stupid question. I’m on the stable 24.05 channel, I upgraded everything and the vulnix command above shows a pleasant green message, so I infer there’s a patch applied on my system.
However, I run this and i see the old version.
sshd --version
unknown option – -
OpenSSH\_9.7p1, OpenSSL 3.0.14 4 Jun 2024
Similarly, on the [NixOS Search](https://search.nixos.org/packages?channel=24.05&show=openssh&from=0&size=50&sort=relevance&type=packages&query=sshd) search page I see openssh has still \* Version: **9.7p1**.
My question is: how do you guys get to see 9.8 without being on unstable? Thank you!
---
### Author:  [@emily](https://discourse.nixos.org/u/emily)
#### Post date: [July 13, 2024, 2:05pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/39 "2024-07-13T14:05:25Z")
We patched 9.6p1 and 9.7p1 with a fix, so everything here is as expected.
---
### Author:  [@tomf](https://discourse.nixos.org/u/tomf)
#### Post date: [July 14, 2024, 2:08pm UTC](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220/40 "2024-07-14T14:08:09Z")
Thanks @emily for your work on ensuring NixOS users received prompt OpenSSH updates during this! 👍
[Previous page](https://discourse.nixos.org/t/security-advisory-openssh-cve-2024-6387-regresshion-update-your-servers-asap/48220.md?page=1)