# [CVE-2024-6387] regreSSHion: OpenSSH Pre-Authentication Remote Code Execution
**Severity:** CRITICAL | **CVSS Base Score:** 8.1 (3.1)
**CVSS Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
**EPSS Exploit Probability:** 94.12% (Percentile: 99.15%)
**CISA KEV (In The Wild):** YES (Due: Mon Jul 29 2024 00:00:00 GMT+0000 (Coordinated Universal Time))
**Known Ransomware Campaigns:** None documented
**Exploit Status:** poc_public
**Published:** 2024-07-01 | **Updated:** 2026-10-28

## Executive Summary
Signal race condition vulnerability in OpenSSH's server (sshd) on glibc-based Linux systems, allowing unauthenticated remote code execution as root.

## Common Weakness Enumeration (CWE)
- **CWE-362**: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- **CWE-479**: Signal Handler Use of a Non-reentrant Function

## Affected Vendors & Products
- **Vendor:** OpenBSD | **Product:** OpenSSH
  - **Affected Versions:** 8.5p1 up to but excluding 9.8p1 (also earlier versions 3.4p1)
  - **Patched Version:** OpenSSH 9.8p1

## Technical Root Cause Analysis (AI Defense Agent)
In OpenSSH 8.5p1, commit b98c080 accidentally removed an `#ifdef DO_LOG_SAFE_IN_SIGHAND` guard around the SIGALRM signal handler in `sigdie()`. Because `syslog()` invokes non-reentrant heap allocators, interrupted malloc operations corrupt the glibc chunk meta-structures, allowing precise heap shaping over hundreds of parallel connections.

## Exploitation Mechanism & Attack Scenario
Exploitation involves winning a split-second race condition during connection timeout on 32-bit and 64-bit architectures by repeatedly flooding the target with parallel connections and manipulating heap alignment until the instruction pointer redirects to shellcode.

## Enterprise Blast Radius
Direct unauthenticated root access to host operating system, full compromise of virtualization hosts, perimeter firewalls, and cloud bastion nodes.

## Remediation & Mitigation Playbook
1. Update OpenSSH packages to version 9.8p1 or vendor backports immediately.
2. Workaround if patching is delayed: set `LoginGraceTime 0` in `/etc/ssh/sshd_config` and reload the service. Note: This exposes sshd to denial of service from open connections.
3. Implement strict network segmentation: sshd ports (22) must never be open to the public internet; enforce VPN, WireGuard, or Cloudflare Access tunnels.

## Detection Guidance & Telemetry
Look for high volumes of closed SSH connections with 'Timeout before authentication for [IP]' in auth.log or secure syslog files.

### Sigma Detection Rule
```yaml
title: OpenSSH regreSSHion Exploitation Attempt
status: high
logsource:
  product: linux
  service: sshd
detection:
  selection:
    message|contains: 'Timeout before authentication for'
  condition: selection | count() by src_ip > 50
```


## References
- [Qualys Security Advisory: regreSSHion (CVE-2024-6387)](https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt) (advisory)
- [OpenSSH 9.8 Release Notes](https://www.openssh.com/txt/release-9.8) (patch)