regreSSHion
- Product
- OpenBSD / OpenSSH OpenSSH server (sshd) on glibc Linux
- CVE
- CVE-2024-6387
- Disclosed
- 2024-07-01
- CVSS
- 8.1
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- OpenSSH 8.5p1 through 9.7p1 (and versions before 4.4p1 lacking backported fixes) on glibc-based Linux
- Fixed
- OpenSSH 9.8p1 and distro backports
Summary
Qualys found that a fix from 2006 (CVE-2006-5051) was accidentally removed in OpenSSH 8.5p1, bringing back a signal-handler race in sshd. An unauthenticated attacker who wins the race can get root code execution on glibc Linux. Exploitation is slow (hours of attempts on 32-bit, longer on 64-bit with ASLR) but needs no credentials.
Root cause
If a client does not authenticate within LoginGraceTime, sshd's SIGALRM handler runs and calls functions that are not async-signal-safe, such as syslog(), which can call malloc/free. Interrupting the main code mid-allocation can corrupt the heap. The #ifdef that kept the handler safe was dropped in a 2020 logging refactor.
Impact
Unauthenticated remote code execution as root on vulnerable sshd, though practical exploitation needs many connection attempts.
Detection
Version check (ssh -V or banner) against 8.5p1-9.7p1 and distro patch levels; large numbers of connections ending with 'Timeout before authentication' in sshd logs. Nuclei has a CVE-2024-6387 version-detection template.
Mitigation
Upgrade to OpenSSH 9.8p1 or a patched distro package; if not possible, set LoginGraceTime 0 (trades RCE for DoS risk) and rate-limit SSH.