CVE-2024-6387 Explained: regreSSHion OpenSSH Signal Handler Race Condition

OpenSSH's sshd allows unauthenticated clients a grace period (LoginGraceTime, default 120 seconds) to complete authentication. If a client fails to authenticate within this window, sshd handles the timeout by raising a SIGALRM signal, which calls the cleanup_exit() function.

The problem: cleanup_exit() calls functions that are not async-signal-safe — specifically, glibc's malloc, free, and related memory management functions. Signal handlers must only call async-signal-safe functions because they can interrupt any point in a running program, including the middle of malloc's internal bookkeeping. Calling malloc from a signal handler that fires during another malloc operation corrupts the heap.

An attacker exploits this by causing the SIGALRM to fire at precisely the right moment during sshd's memory operations. With enough attempts (~10,000 connections), the timing can be won. Once the heap is corrupted in the right way, it becomes possible to redirect execution to attacker-controlled shellcode. On 32-bit systems, ASLR provides insufficient entropy to prevent exploitation. On 64-bit systems, exploitation is significantly harder but theoretically possible with sufficient attempts.

The CVSS score of 8.1 reflects the attack complexity — the race condition requires thousands of attempts and hours of sustained effort, which depresses the score from the 10.0 it would receive if exploitation were trivial. But high attack complexity does not mean the vulnerability can be ignored.

For targeted attacks against high-value systems by well-resourced threat actors, an 8-hour exploitation window is operationally viable. Qualys demonstrated successful exploitation on 32-bit x86 systems in their lab. On 64-bit x86-64 systems — the dominant deployment — ASLR entropy is much higher (approximately 2^28 for heap layout randomisation), making the attack take days rather than hours without additional information leaks.

Approximately 700,000 of the 14 million exposed systems were identified as running vulnerable versions without patches applied as of July 2024. Enterprise Linux distributions (RHEL 9, Ubuntu 22.04 LTS, Debian 12) all shipped patched packages within days of the disclosure.

The fix is straightforward — upgrade OpenSSH. The workaround is also simple and immediately effective while patch deployment is underway.

regreSSHion is the kind of vulnerability that gets underestimated because of a CVSS score that reflects attack complexity rather than the severity of a successful outcome. Unauthenticated root RCE on any internet-exposed Linux SSH daemon is a maximum-severity outcome — the score just acknowledges that achieving it takes real work.

The regression story is also a supply-chain-of-time lesson: a security patch from 2006 was undone by a code change in 2021, and nobody caught it for three years despite OpenSSH being one of the most audited codebases in open-source software. The reintroduced flaw sat in hundreds of millions of deployments worldwide until a Qualys researcher found it.

If you run Linux servers with SSH exposed to the internet — which is most of them — patch this now. The upgrade to OpenSSH 9.8p1 is straightforward. The workaround (LoginGraceTime 0) takes thirty seconds. The only thing required to be at risk is running an unpatched sshd on a public-facing host, which describes most of the internet.