regreSSHion (CVE-2024-6387).

An unauthenticated remote code execution flaw in OpenSSH server caused by a signal handler race condition reachable before authentication. It belongs to the Vulnerabilities category of cybersecurity.

An unauthenticated remote code execution flaw in OpenSSH server caused by a signal handler race condition reachable before authentication.

regreSSHion is a critical OpenSSH vulnerability disclosed by Qualys in July 2024 and tracked as CVE-2024-6387. It re-introduces a previously fixed bug (CVE-2006-5051) in the sshd signal handler: when a client fails to authenticate within LoginGraceTime, sshd raises SIGALRM and invokes async-signal-unsafe functions, creating a race that can be turned into pre-auth remote code execution as root. Affected versions include OpenSSH 8.5p1 through 9.7p1 on glibc Linux. Practical exploitation is slow and noisy but viable on internet-facing servers. Mitigation is upgrading to 9.8p1 or later, or setting LoginGraceTime 0 as a temporary control.

Defences for regreSSHion (CVE-2024-6387) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2024-6387, OpenSSH signal handler race.