CVE-2024-54855: Vanilla OS 2 SSH Key Exposure Vulnerability

CVE-2024-54855 Overview

CVE-2024-54855 is a cryptographic vulnerability affecting fabricators Ltd Vanilla OS 2 Core image v1.1.0. The vulnerability stems from the use of static (hardcoded) keys for the SSH service, which allows attackers to potentially execute man-in-the-middle (MITM) attacks during SSH connections with other hosts. This type of vulnerability falls under CWE-321: Use of Hard-coded Cryptographic Key.

Critical Impact

Attackers who obtain the static SSH keys can intercept, decrypt, and potentially modify SSH communications between the affected system and other hosts, compromising the confidentiality and integrity of sensitive data transmitted over SSH sessions.

Affected Products

• fabricators Ltd Vanilla OS 2 Core image v1.1.0

Discovery Timeline

• 2026-01-13 - CVE CVE-2024-54855 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2024-54855

Vulnerability Analysis

This vulnerability involves the use of static (hardcoded) cryptographic keys within the SSH service configuration of Vanilla OS 2 Core image. When SSH host keys are static and shared across multiple deployments, any attacker who obtains these keys can impersonate the server or decrypt captured traffic.

The network-based attack vector means this vulnerability can be exploited remotely without requiring physical access to the target system. While some privileges and user interaction may be required in certain attack scenarios, the potential impact on confidentiality and availability is significant.

Root Cause

The root cause is the inclusion of pre-generated, static SSH host keys in the Vanilla OS 2 Core image distribution. During the image creation process, SSH keys were generated and bundled directly into the image rather than being generated uniquely during first boot or initial system configuration. This practice violates secure key management principles, as every deployment of this image shares the same cryptographic identity.

Attack Vector

An attacker exploiting this vulnerability would typically:

1. Obtain a copy of the Vanilla OS 2 Core image v1.1.0 to extract the static SSH host keys
2. Position themselves in a network location where they can intercept traffic between the victim and an affected Vanilla OS system
3. Use the extracted keys to perform a man-in-the-middle attack, presenting the legitimate-looking SSH host key to connecting clients
4. Intercept, decrypt, and potentially modify SSH session data in real-time

The vulnerability enables MITM attacks because SSH clients typically verify server identity through host key fingerprints. With static keys, the attacker's system presents the same fingerprint as legitimate systems, bypassing this security mechanism.

Detection Methods for CVE-2024-54855

Indicators of Compromise

• SSH host key fingerprints matching known static keys from the vulnerable Vanilla OS 2 Core image v1.1.0
• Multiple systems in the environment reporting identical SSH host key fingerprints
• Unusual SSH connection anomalies or certificate warnings in network monitoring tools

Detection Strategies

• Inventory all systems running Vanilla OS 2 Core image and verify the version deployed
• Compare SSH host key fingerprints across systems; identical fingerprints indicate the presence of static keys
• Implement network monitoring to detect potential MITM attack signatures on SSH traffic
• Review SSH connection logs for anomalies that could indicate interception attempts

Monitoring Recommendations

• Enable verbose SSH logging to capture connection metadata and key exchange information
• Monitor for unexpected SSH host key changes in ~/.ssh/known_hosts files on client systems
• Implement network intrusion detection rules for SSH-based MITM attack patterns
• Establish a baseline inventory of legitimate SSH host key fingerprints for comparison

How to Mitigate CVE-2024-54855

Immediate Actions Required

• Regenerate unique SSH host keys on all systems running the affected Vanilla OS 2 Core image v1.1.0
• Remove or replace the existing static SSH host keys located in /etc/ssh/
• Update client-side known_hosts files to reflect the new host key fingerprints
• Review SSH connection logs for any suspicious activity that may indicate prior exploitation

Patch Information

Users should consult the GitHub Security Advisory GHSA-67pc-hqr2-g34h for the latest remediation guidance and updated image releases. If an updated image version is available, upgrading is recommended. For existing deployments, SSH key regeneration is the primary remediation.

Workarounds

• Regenerate SSH host keys immediately using the system's SSH key generation utilities
• Remove static keys before deploying new instances based on the affected image
• Implement network segmentation to limit exposure of SSH services to untrusted networks
• Consider using SSH certificate authentication as an additional layer of identity verification

# SSH key regeneration example
# Remove existing static host keys
sudo rm -f /etc/ssh/ssh_host_*

# Regenerate new unique host keys
sudo ssh-keygen -A

# Restart SSH service to apply new keys
sudo systemctl restart sshd