Researchers revealed a signal handler race condition RegreSSHion vulnerability that puts OpenSSH servers at risk. The flaw is tracked as CVE-2024-6387 and got a high severity CVSS – 8.1.

Hackers can exploit it to obtain unauthenticated remote code execution (RCE) with root privileges. According to security researchers, this is the first unauthenticated RCE flaw they’ve discovered in OpenSSH in nearly two decades.

Why call it RegreSSHion?

CVE-2024-6387 is a regression of CVE-2006-5051. That old vulnerability enabled hackers to launch a DoS attack and execute arbitrary code remotely in 2006.

CVE-2006-5051 got a patch at that moment, but now the issue resurfaced in a more recent OpenSSH release. This is why researchers call CVE-2024-6387 a “regreSSHion” flaw.

According to BleepingComputer, here’s how CVE-2024-6387 works:

If a client does not authenticate within LoginGraceTime seconds (120 by default), then sshd’s SIGALRM handler is called asynchronously and calls various functions that are not async-signal-safe.

Source –

Who’s vulnerable to CVE-2024-6387?

Allegedly, MacOS and Windows could also be vulnerable to the RegreSSHion flaw. However, researchers did not yet confirm exploitability on these systems.

CVE-2024-6387, in its current and previous form, affects the following instances:

  • OpenSSH servers on Linux versions starting 8.5p1 up to but except 9.8p1
  • Versions prior to 4.4p1 that were not patched for CVE-2006-5051 and CVE-2008-4109

The new RegreSSHion flaw does not impact Linux versions from 4.4p1 up to, but except, 8.5p1 if they got a patch for CVE-2006-5051.

Mitigation measures

For now, there is no proof that hackers are already exploiting the new RegreSSHion flaw. However, due to its high severity score, we recommend taking prevention measures.

best patch management software

If you liked this article, follow us on LinkedIn, Twitter, Facebook, and Youtube, for more cybersecurity news and topics.

Author Profile

Livia Gyongyoși is a Communications and PR Officer within Heimdal®, passionate about cybersecurity. Always interested in being up to date with the latest news regarding this domain, Livia’s goal is to keep others informed about best practices and solutions that help avoid cyberattacks.