regreSSHion: Qualys Discloses OpenSSH Server Vulnerability (CVE-2024-6387)

What happened

On July 1, 2024, the Qualys Threat Research Unit published an advisory disclosing CVE-2024-6387, which it nicknamed regreSSHion, a vulnerability in OpenSSH's server, sshd. Qualys described the issue as a signal-handler race condition. OpenSSH is one of the most widely used tools for remote server access, which is why the disclosure drew broad attention.

The technical facts

According to the Qualys advisory, if a client does not authenticate within the LoginGraceTime period, sshd's SIGALRM handler is called asynchronously, but that handler calls functions that are not async-signal-safe. Qualys identified this as a regression of an older 2006 vulnerability, CVE-2006-5051, reintroduced in OpenSSH 8.5p1 (October 2020) when an important guard was accidentally removed. The race condition affects sshd in its default configuration.

Affected versions and researcher findings

Qualys reported that OpenSSH versions from 8.5p1 up to but not including 9.8p1 are vulnerable again to this race condition, while versions from 4.4p1 up to 8.5p1 were not affected because of the earlier fix. The advisory stated the vulnerability is exploitable on glibc-based Linux systems and demonstrated, in a lab setting, that it could lead to unauthenticated remote code execution as root, though the researchers noted the attack required many attempts and significant time to win the race, and that they had targeted virtual machines rather than bare-metal servers. OpenBSD was noted as not vulnerable.

Remediation

The OpenSSH project addressed the issue in OpenSSH 9.8p1. Administrators were advised to upgrade to the fixed release. As an interim mitigation where patching was not immediately possible, Qualys noted that setting LoginGraceTime to 0 in the sshd configuration removes the timing window used by the attack, at the cost of exposing sshd to a potential connection-exhaustion denial of service. Standard network hygiene, such as restricting SSH exposure, also reduces risk.

Why it mattered

regreSSHion was notable because OpenSSH is deeply embedded in server infrastructure, so a potential unauthenticated root RCE in the default configuration was serious. Qualys emphasised OpenSSH's otherwise strong security record and framed the bug as a rare regression rather than a systemic weakness. The episode was also a reminder of how a subtle change, made years earlier, can silently reintroduce a previously fixed vulnerability.

Related on Skillo

See also: the OpenSSL 3.0.7 buffer-overflow advisory.

Sources

• Qualys Security Advisory: regreSSHion (CVE-2024-6387)
• CVE-2024-6387 record (CVE.org)

Published date reflects the original event date (2024-07-01). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.