OpenSSH regreSSHion (CVE-2024-6387) Unauthenticated RCE on glibc Linux

CVE-2024-6387 (nicknamed regreSSHion) is a signal-handler race in OpenSSH's server (sshd) on glibc-based systems. Under the right timing conditions an unauthenticated remote attacker may achieve code execution as root on affected builds.

Affected versions

• OpenSSH < 4.4p1 unless patched for CVE-2006-5051
• OpenSSH 8.5p1 through 9.7p1 (before 9.8p1)
• Linux distros shipping vulnerable sshd packages

Check your server

ssh -V
sshd -V 2>&1 | head -1
rpm -q openssh-server 2>/dev/null || dpkg -l openssh-server

Mitigation (do this now)

• Upgrade to OpenSSH 9.8p1 or your vendor's fixed package
• Restrict SSH with firewall/VPN; disable password auth
• Set LoginGraceTime 0 in sshd_config as a temporary workaround
• Monitor auth logs for repeated pre-auth disconnects from one IP

Severity: Critical (CVSS up to 8.1). Public exploit research exists; treat internet-facing sshd as high priority for patching.