OpenSSH 9.8 Fixes the Critical regreSSHion Flaw

A critical security release

OpenSSH 9.8 was released on July 1, 2024, containing fixes for two security problems, one critical and one minor. It arrived as a widely-covered patch after a serious server-side vulnerability was disclosed.

The regreSSHion race condition

The critical fix addressed a race condition in sshd, present in portable OpenSSH between 8.5p1 and 9.7p1 inclusive, that may allow arbitrary code execution with root privileges. OpenSSH said successful exploitation was demonstrated on 32-bit Linux/glibc systems with ASLR, requiring on average 6-8 hours of continuous connections, and credited the Qualys Security Advisory Team with discovering and demonstrating it. OpenBSD was not vulnerable.

A keystroke timing logic error

The minor fix corrected a logic error in the ssh ObscureKeystrokeTiming feature in versions 9.5 through 9.7, which rendered the countermeasure ineffective because both fake and real keystroke packets were sent unconditionally, letting a passive observer still identify real keystrokes. The bug also broke a long-standing mitigation dating to OpenSSH 2.9.9 that sends fake keystroke echoes for TTYs in echo-off mode, such as password entry into su or sudo.

A split server and attacker penalties

OpenSSH 9.8 split the server into a listener binary, sshd, and a per-session binary, sshd-session, allowing a much smaller listener that no longer needs to support the SSH protocol. It also added PerSourcePenalties, on by default, which blocks client addresses that repeatedly fail authentication, connect without completing authentication, or crash the server. The release disabled DSA by default at compile time, the second step in OpenSSH's plan to remove the weak signature algorithm entirely in early 2025.

Related on Skillo

See also: OpenSSH 9.6 and the Terrapin attack fix.

Sources

• OpenSSH 9.8 release notes (openssh.com)

Published date reflects the original event date (2024-07-01). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.