OpenSSH regreSSHion (CVE-2024-6387) Explained

Video transcript

In July 2024, Qualys disclosed regreSSHion, an OpenSSH flaw that could give unauthenticated attackers root on glibc-based Linux.

Qualys counted over 14 million potentially vulnerable OpenSSH servers exposed to the internet.

The login timeout handler called unsafe functions like syslog. It is the same bug fixed in 2006, accidentally reintroduced by a 2020 logging change.

Versions 8.5 through 9.7 are vulnerable, as are very old unpatched releases. Version 9.8 fixes it. Check your distribution's advisory too.

Attackers open connections and never log in. Each time the timer fires, there is a small chance to win the race. Win it, and code runs as root.

Qualys's 32-bit exploits averaged about 10,000 tries, roughly six to eight hours to root. 64-bit exploitation had not been demonstrated at release.

On validator hosts, the SSH server runs as root, so an exploit hands over the host and its keys. Network access decides who can try.

Inventory every SSH host and upgrade to 9.8 or your distribution's fix. Restrict port 22, and alert on bursts of login timeouts.

Qualys says setting login grace time to zero removes the code execution risk. But attackers can then exhaust connections, which can lock you out.

Guardian's Managed Security matches new disclosures to your systems in real time, and an engineer helps you patch. Read the full article, or talk to Guardian.

On July 1, 2024, Qualys disclosed a flaw in OpenSSH's server that could give an unauthenticated attacker a root shell. It named the flaw regreSSHion.

SSH is the usual way operators reach the Linux hosts behind nodes, validators and exchange systems. Qualys counted over 14 million potentially vulnerable OpenSSH servers exposed to the internet.

OpenSSH 9.8, released the same day, fixed it.

What the Flaw Is

OpenSSH's server, sshd, gives each client a time limit to log in, set by LoginGraceTime. When the limit expires, a signal handler for SIGALRM runs.

That handler called functions that are not safe to call inside a signal handler, such as syslog(), Qualys found. The flaw is reachable in sshd's default configuration.

It is a regression. The same bug, CVE-2006-5051, was reported by Mark Dowd in 2006 and fixed.

An October 2020 change to OpenSSH's logging, which shipped in 8.5p1, accidentally removed the safeguard, according to Qualys.

OpenBSD is not vulnerable. Its handler uses syslog_r(), a safer version of the call.

How the Attack Works

The attacker opens connections and never finishes logging in. Each time the timer fires, there is a small chance to win the race and corrupt sshd's memory.

Win it, and the attacker runs code as root. Qualys warned of "full system compromise" with "the highest privileges."

How long it takes

Qualys built working exploits for 32-bit Linux. Each needed about 10,000 tries on average.

• Debian 12.5.0, OpenSSH 9.2p1: about 3 to 4 hours to win the race.
• Same target, root shell: about 6 to 8 hours on average, since ASLR halves the odds of guessing glibc's address.
• 64-bit systems: exploitation "is believed to be possible but has not been demonstrated," OpenSSH said at release.

Qualys called a 64-bit exploit "much harder because of the stronger ASLR." NVD scores the flaw 8.1, High, and rates attack complexity as high.

What an attempt looks like

Hours of abandoned logins leave a trace. Qualys says many "Timeout before authentication" lines in sshd logs may indicate exploitation attempts.

Timeline and Exposure

Here is the exposure, with each figure attributed.

• Internet-facing: over 14 million potentially vulnerable OpenSSH servers, from Qualys's Censys and Shodan searches.
• Confirmed in one base: about 700,000 vulnerable instances, 31% of internet-facing OpenSSH in Qualys's customer data.
• Exploitation status: as of November 6, 2026, CISA's Known Exploited Vulnerabilities catalog does not list it.
• CISA's assessment: its SSVC entry on the NVD record, dated July 2, 2024, rates exploitation as proof of concept.
• Loss: none of the sources we read reports one.

What It Meant for Validators

Validators, RPC nodes, signing hosts and exchange back ends often run on Linux servers that operators administer over SSH.

The sshd process runs as root, so a working exploit hands over the host and whatever keys and services it holds.

Network access decides who can try. Anza's validator requirements, for example, recommend allowing SSH on port 22 only from a static management IP.

A host set up that way never shows sshd to an outside attacker. A host with port 22 open to the internet lets anyone keep trying.

The workaround has a cost

Qualys says setting LoginGraceTime to 0 removes the code execution risk. But an attacker can then exhaust sshd's MaxStartups connections, a denial of service.

For an operator, that can mean being locked out of SSH when access matters most.

Check your distribution, not just the version

Distributions shipped their own fixes; NVD's record lists Red Hat errata such as RHSA-2024:4312. Check your distribution's advisory as well as the upstream version string.

What It Shows

• Fixed bugs come back. A 2006 fix was undone by a 2020 logging change.
• Exposure is the multiplier. The same bug behind a management network is far harder to reach.
• Slow attacks leave traces. Hours of failed handshakes show up in logs if someone is watching.
• Inventory decides speed. You can only patch the hosts you know about.

Checks to run

• List every host running sshd, with its package version and distribution.
• Upgrade to OpenSSH 9.8p1 or your distribution's fixed package.
• Allow port 22 only from a management IP, VPN or bastion host.
• Alert on bursts of "Timeout before authentication" in sshd logs.
• Use LoginGraceTime 0 only as a stopgap, and plan for the denial-of-service tradeoff.

For a 2026 case of a critical flaw below the application, see why Solana validators were warned about a Linux kernel CVE.

How Guardian Tracks Advisories

Guardian's Managed Security tracks disclosures live. Guardian ingests vulnerability disclosures in real time and matches them against your system.

Where one reaches you, an engineer confirms the exposure and works with you to patch it.

Shield, part of Managed Security, is Guardian's continuous coverage of everything facing the internet: hosts, ports, services, storage, certificates and edge rules.

It runs reconnaissance and penetration testing around the clock, with no special access needed from you.

For a point-in-time test, Guardian's Infrastructure Pentest escalates through your cloud accounts like an intruder, until something signs. For scope and method, read Web3 penetration testing explained.

Frequently Asked Questions

What is CVE-2024-6387?

CVE-2024-6387, or regreSSHion, is a signal handler race condition in OpenSSH's server, sshd. Qualys showed it can give an unauthenticated attacker code execution as root on glibc-based Linux. It was disclosed and fixed on July 1, 2024.

Which OpenSSH versions are affected?

Portable OpenSSH 8.5p1 through 9.7p1, plus versions before 4.4p1 that lack the 2006 and 2008 fixes. Versions 4.4p1 up to 8.5p1 are not affected, OpenBSD is not vulnerable, and OpenSSH 9.8 fixes it.

Was regreSSHion exploited in the wild?

As of November 6, 2026, CISA's Known Exploited Vulnerabilities catalog does not list it. Qualys demonstrated exploitation on 32-bit Linux, and OpenSSH said 64-bit exploitation had not been demonstrated at release.

What if I cannot patch right away?

Restrict SSH to trusted networks first. Qualys says setting LoginGraceTime to 0 removes the code execution risk, but an attacker can then exhaust MaxStartups connections and deny service to sshd.

Sources

• Qualys: regreSSHion, remote unauthenticated code execution in OpenSSH's server, security advisory (July 1, 2024)
• Qualys: Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion) (July 1, 2024)
• OpenSSH: Release notes for OpenSSH 9.8 (July 1, 2024)
• NVD: CVE-2024-6387 (July 1, 2024)
• CISA: Known Exploited Vulnerabilities Catalog (checked November 6, 2026)
• Anza: Agave validator requirements
• Guardian: Managed Security
• Guardian: Cloud and Infrastructure Penetration Testing