OpenSSH
CVE-2024-6387
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed sshd on glibc Linux
-
DeliveryOpen many concurrent TCP connections to port 22
-
ExploitStall SSH handshake past LoginGraceTime
-
ExecutionRace SIGALRM handler to corrupt heap
-
PersistAchieve code execution as root
-
ImpactEstablish persistence and pivot internally
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Target must be running OpenSSH portable sshd on a glibc-based Linux system (Ubuntu, RHEL/AlmaLinux, Debian, Amazon Linux, SUSE, or affected vendor appliances such as SonicWall SMA and NetApp ONTAP) with versions <4.4p1 or 8.5p1 through 9.7p1 inclusive, and sshd reachable over the network on its listening port (typically TCP/22). The LoginGraceTime directive must be non-zero (default is 120 seconds) - setting it to 0 eliminates the race. Exploitation requires the attacker to sustain thousands of connection attempts over a long window (Qualys reported 6-8 hours on 32-bit glibc systems, longer on 64-bit), so any tight network-level rate limiting, MaxStartups throttling, or short-lived IP allowlisting materially limits feasibility. OpenBSD's native sshd is not affected; FreeBSD/NetBSD and macOS are typically not exploitable via the same primitive due to differing allocator behavior, though they remain technically vulnerable to the race. |
| Impact | The CVSS vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H reflects a network-reachable, unauthenticated flaw with high attack complexity - accurately capturing that exploitation requires winning a tight race (Qualys' original PoC needed 6-8 hours of repeated connections on 32-bit glibc, longer on 64-bit). Despite the high complexity, EPSS at 48.06% (98th percentile) and publicly available exploit code make this a high-priority remediation target for any internet-exposed sshd. However, the CVE is notably absent from CISA KEV, suggesting that while widespread scanning has been observed, reliable mass exploitation in the wild has not been confirmed at scale - consistent with the multi-hour race-window requirement and architecture-specific exploitation primitives. The signals are partially conflicting: very high EPSS and public PoC point to elevated risk, but no KEV listing and high attack complexity moderate the immediacy versus a trivially weaponized RCE. Net assessment: high priority for internet-facing OpenSSH on glibc Linux, lower urgency for BSD-based or non-exposed deployments. |
| Exploit ScenarioDerived | An attacker on the internet repeatedly opens TCP connections to a victim's sshd on port 22 and deliberately stalls the SSH key exchange so that LoginGraceTime expires; over thousands of connection attempts spanning hours, they race the SIGALRM handler to corrupt heap state in a controlled way. Using the publicly available Qualys-derived PoC, the attacker eventually achieves remote code execution as root on the target glibc Linux host. From there they pivot into the internal network, harvest credentials, and establish persistence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to exploit a signal handler race condition by failing to authenticate within the LoginGraceTime window, potentially yielding root-level code execution on glibc-based Linux systems. The flaw - widely known as 'regreSSHion' - affects numerous distributions and vendor appliances including Ubuntu 23.10/24.04, AlmaLinux 9, SonicWall SMA firmware, Arista EOS, NetApp ONTAP, and others. Publicly available exploit code exists and EPSS scores it at 48.06% (98th percentile), reflecting very high exploitation likelihood, though it is not currently listed in CISA KEV.
RemediationAI
Apply the vendor-released patch: upgrade to OpenSSH 9.8p1 or later, which restructures signal handling to remove the race. Distribution-specific backported packages are available - apply updates from Canonical (Ubuntu USN), Red Hat (RHSA for RHEL/OpenShift), AlmaLinux, Debian, Amazon Linux, SUSE, and NetApp/SonicWall/Arista vendor advisories as soon as available; consult the Red Hat advisory at access.redhat.com and the Qualys disclosure at blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server for cross-references. If immediate patching is not feasible, the documented workaround is to set LoginGraceTime 0 in sshd_config and restart sshd, which closes the race window but exposes sshd to denial-of-service via connection exhaustion (all MaxStartups slots can be held open indefinitely by attackers). Additional compensating controls include restricting sshd network exposure with firewall ACLs to known management ranges only, deploying rate-limiting via fail2ban or iptables connection-rate rules on TCP/22, and prioritizing patching for any internet-facing glibc Linux systems over BSD-based hosts.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-364 (Signal Handler Race Condition) in OpenSSH's sshd privileged process. When a client fails to authenticate within LoginGraceTime (default 120 seconds), sshd's SIGALRM handler invokes functions that are not async-signal-safe (such as syslog() and its downstream malloc/free paths). An attacker who repeatedly opens TCP connections to port 22 and stalls authentication can race the signal handler against heap state, leading to memory corruption that on glibc Linux has been demonstrated to yield code execution as root. The underlying technology is the OpenSSH portable server (sshd), a regression reintroduced after CVE-2006-5051 in OpenSSH 8.5p1 when a critical logging guard was removed; versions prior to 4.4p1 and from 8.5p1 through 9.7p1 are affected. Non-glibc systems (OpenBSD, and possibly *BSD variants listed in CPE such as FreeBSD/NetBSD) are not exploitable in the same way due to differing malloc internals.
Know when Openssh gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Executive ViewAI
OpenSSH sshd contains a critical signal handler race condition (CVE-2024-6387) enabling unauthenticated remote code execution as root on Linux systems including Ubuntu 23.10/24.04, AlmaLinux 9, and numerous vendor appliances. Publicly available exploit code combined with 98th percentile exploitation likelihood (EPSS 48.06%) creates immediate risk to any organization with internet-facing SSH services. Vendor patches are available and require urgent deployment.
Apply vendor patch. Interim mitigation while patching is deployed: restrict SSH access via firewall to approved administrative source networks, implement network segmentation isolating SSH services, and enable detailed logging of SSH authentication failures to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remot
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
An issue was discovered in OpenSSH 7.9. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-T
A flaw was found in the OpenSSH package. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, n