regreSSHion: OpenSSH CVE-2024-6387 Puts 14 Million Servers at Risk of Unauthenticated Root RCE

OpenSSH's sshd daemon allows clients a configurable grace period (LoginGraceTime, default 120 seconds) to complete authentication after connecting. When that period expires without successful authentication, sshd sends itself a SIGALRM signal to terminate the session. The SIGALRM handler calls syslog(), malloc(), and free(), which are not async-signal-safe. If a signal arrives while sshd is inside one of these functions on the main thread, the program state is undefined. An attacker who sends thousands of connections per hour can statistically win this race condition repeatedly, using the resulting heap corruption to achieve code execution as the sshd process user, which on most Linux distributions is root.

The vulnerability exists in versions 8.5p1 through 9.7p1 on glibc-based Linux systems. The glibc heap allocator's behavior under corruption is a critical dependency for exploitation; systems using musl libc (Alpine Linux) or BSD malloc (OpenBSD) are unexploitable or unaffected. On 32-bit systems without ASLR, Qualys demonstrated exploitation in their lab with a few thousand connections. On 64-bit systems with ASLR, exploitation requires brute-forcing address randomization across tens of thousands of attempts over several hours.

The definitive fix is upgrading to OpenSSH 9.8p1 or later. Major distributions shipped patches within 48 hours of the July 1, 2024 disclosure: Debian backported the fix to OpenSSH 9.2p1-2+deb12u3, Ubuntu 22.04 LTS to 1:8.9p1-3ubuntu0.10, RHEL 9 to openssh-8.7p1-38.el9, and Alpine Linux to 9.7_p1-r2 with the race condition patched at the source level.

If immediate upgrade is not possible: set LoginGraceTime 0 in /etc/ssh/sshd_config and run 'systemctl reload sshd'. This disables the timeout mechanism entirely, which eliminates the SIGALRM trigger but also removes a built-in protection against unauthenticated connection floods. Compensate by enforcing per-IP rate limits at the firewall level (allow a maximum of 10 new SSH connections per IP per minute) and enabling fail2ban or equivalent.

Additional hardening: disable password authentication in favor of public key only (PasswordAuthentication no), restrict SSH access by source IP using AllowFrom in sshd_config or firewall rules, and consider moving sshd to a non-standard port to reduce automated scanning noise.

Exploitation leaves a distinctive network and log signature: thousands of short-lived connections to port 22 from a single IP, each lasting approximately 120 seconds before disconnect. The authentication log will show repeated 'Connection closed by [IP] port [N] [preauth]' entries at 120-second intervals from the attacking IP.

At the host level, monitor for sshd worker process crashes using journalctl or /var/log/auth.log. A successful race condition win may cause sshd to log a segfault or abnormal termination before the attacker gains code execution. The sshd parent process respawns workers automatically, so brief crash loops visible in system logs are a key indicator.

Netflow or firewall logs will show an unusually high connection rate to port 22 from a single external IP over several hours, well above the expected authentication retry patterns of automated scanners.