{"status":"success","data":{"id":"CVE-2024-6387","slug":"cve-2024-6387-regresshion-openssh-rce","title":"regreSSHion: OpenSSH Pre-Authentication Remote Code Execution","summary":"Signal race condition vulnerability in OpenSSH's server (sshd) on glibc-based Linux systems, allowing unauthenticated remote code execution as root.","description":"A signal handler race condition in OpenSSH's server (sshd) allows unauthenticated remote attackers to execute arbitrary code with root privileges on glibc-based Linux distributions. If a client does not authenticate within LoginGraceTime seconds (default 120 seconds), sshd's SIGALRM handler executes asynchronously and calls several functions that are not async-signal-safe (e.g., syslog(), malloc(), free()), leading to heap corruption.","severity":"CRITICAL","cvss_score":8.1,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","privilegesRequired":"NONE"},"epss_score":0.9412,"epss_percentile":0.9915,"cisa_kev":true,"cisa_date_added":"2024-07-08T00:00:00.000Z","cisa_due_date":"2024-07-29T00:00:00.000Z","ransomware_campaign":null,"threat_actors":["Nation-state reconnaissance clusters","Automated SSH scanning botnets"],"exploit_status":"poc_public","cwes":[{"id":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"},{"id":"CWE-479","name":"Signal Handler Use of a Non-reentrant Function"}],"affected_vendors":["OpenSSH","Ubuntu","Debian","Red Hat","Alpine"],"affected_products":[{"cpe":"cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*","vendor":"OpenBSD","product":"OpenSSH","fixed_version":"OpenSSH 9.8p1","affected_versions":"8.5p1 up to but excluding 9.8p1 (also earlier versions 3.4p1)"}],"ai_analysis":{"sigma_rule":"title: OpenSSH regreSSHion Exploitation Attempt\nstatus: high\nlogsource:\n  product: linux\n  service: sshd\ndetection:\n  selection:\n    message|contains: 'Timeout before authentication for'\n  condition: selection | count() by src_ip > 50","analyzed_at":"2026-10-28T09:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"A resurrected regression in OpenSSH (hence regreSSHion) that re-introduced a critical signal-handler race condition from 2006. Enables remote root compromise of internet-exposed Linux systems.","detection_guidance":"Look for high volumes of closed SSH connections with 'Timeout before authentication for [IP]' in auth.log or secure syslog files.","mitigation_playbook":["Update OpenSSH packages to version 9.8p1 or vendor backports immediately.","Workaround if patching is delayed: set `LoginGraceTime 0` in `/etc/ssh/sshd_config` and reload the service. Note: This exposes sshd to denial of service from open connections.","Implement strict network segmentation: sshd ports (22) must never be open to the public internet; enforce VPN, WireGuard, or Cloudflare Access tunnels."],"technical_root_cause":"In OpenSSH 8.5p1, commit b98c080 accidentally removed an `#ifdef DO_LOG_SAFE_IN_SIGHAND` guard around the SIGALRM signal handler in `sigdie()`. Because `syslog()` invokes non-reentrant heap allocators, interrupted malloc operations corrupt the glibc chunk meta-structures, allowing precise heap shaping over hundreds of parallel connections.","exploitation_mechanism":"Exploitation involves winning a split-second race condition during connection timeout on 32-bit and 64-bit architectures by repeatedly flooding the target with parallel connections and manipulating heap alignment until the instruction pointer redirects to shellcode.","enterprise_blast_radius":"Direct unauthenticated root access to host operating system, full compromise of virtualization hosts, perimeter firewalls, and cloud bastion nodes."},"references":[{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","type":"advisory","title":"Qualys Security Advisory: regreSSHion (CVE-2024-6387)"},{"url":"https://www.openssh.com/txt/release-9.8","type":"patch","title":"OpenSSH 9.8 Release Notes"}],"published_at":"2024-07-01T00:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}