regreSSHion: CVE-2024-6387 in OpenSSH

A race condition in sshd from Portable OpenSSH 8.5p1 to 9.7p1 that can lead to root code execution.

Published in the NVD on 01/07/2024

CVE-2024-6387

CVSS 3.1: 8.1 (high)

Not in the CISA catalogue of actively exploited vulnerabilities

Exploitation probability (EPSS, 01/11/2026): 99.506 %, percentile 99.946

What is regreSSHion?

regreSSHion is a race condition in the OpenSSH server sshd. If a client does not authenticate within the allowed time, sshd handles a signal in an unsafe way. It is a regression of the old flaw CVE-2006-5051 and affects Portable OpenSSH 8.5p1 to 9.7p1.

The NVD rates it at CVSS 8.1. According to the OpenSSH release notes, code execution as root has been shown on 32-bit Linux systems with glibc, on average after 6 to 8 hours of continuous connections; OpenBSD is not affected. CISA does not list the flaw as actively exploited.

Affected and fixed versions

Portable OpenSSH

Affected: 8.5p1 - 9.7p1

Fixed in 9.8p1

Status in Debian and Ubuntu

Debian 12: openssh

Fixed

Fixed from package version 1:9.2p1-2+deb12u3

Debian 13: openssh

Fixed

Fixed from package version 1:9.7p1-7

Ubuntu 22.04 LTS: openssh

Fixed

Fixed from package version 1:8.9p1-3ubuntu0.10

Ubuntu 24.04 LTS: openssh

Fixed

Fixed from package version 1:9.6p1-3ubuntu13.3

What to do

Update OpenSSH to 9.8p1 or install the fixed package of your distribution, on Debian 12 version 1:9.2p1-2+deb12u3 or later.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch openssh (Debian 12)

Watch openssh (Ubuntu 24.04 LTS)

Already have an account? Log in and add openssh (Debian 12)