CVE-2008-4109
7.80.34%
CVE-2008-4109: The Zombie Deadlock — When Logging Kills Your SSH Daemon
Amit Schendel
Senior Security ResearcherJan 2, 2026·6 min read·4 visits
PoC Available
Executive Summary (TL;DR)
In 2008, multiple Linux distributions patched an OpenSSH vulnerability but accidentally introduced a deadlock condition. By calling `syslog()` inside a `SIGALRM` handler, `sshd` processes could hang indefinitely if interrupted while logging. Attackers could exhaust connection slots (`MaxStartups`), causing a total Denial of Service. This pattern resurfaced in 2024 as CVE-2024-6387, proving that dead code eventually comes back to bite.
A deep dive into a notorious signal handler race condition in OpenSSH that turns security logging into a Denial of Service weapon. This vulnerability highlights the perils of non-async-signal-safe functions and serves as the direct ancestor to the 2024 'regreSSHion' RCE.
Technical Appendix
CVSS Score
7.8/ 10
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:CEPSS Probability
0.34%
Top 99% most exploited
Affected Systems
Debian Etch (4.0)Debian Sid/LennyUbuntu 6.06 LTSUbuntu 7.10Ubuntu 8.04 LTSSUSE Linux Enterprise
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
openssh-server Debian | < 4.3p2-9etch3 | 4.3p2-9etch3 |
openssh-server Canonical | Ubuntu 8.04 LTS < USN-649-1 | USN-649-1 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-364 (Signal Handler Race Condition) |
| Attack Vector | Network (AV:N) |
| CVSS Score | 7.8 (High) |
| Impact | Denial of Service (DoS) / Deadlock |
| Privileges Required | None (Pre-auth) |
| Exploit Status | Proof of Concept Available |
MITRE ATT&CK Mapping
CWE-364
Signal Handler Race Condition
The software handles a signal in a way that causes the software to enter a state in which it is no longer responsive.
Known Exploits & Detection
Vulnerability Timeline
CVE-2006-5051 discovered (Original Signal Race)
2006-09-28
Distributions patch 2006-5051 but introduce deadlock (CVE-2008-4109)
2008-09-00
Public disclosure and fixes for CVE-2008-4109
2008-09-28
Qualys discloses regreSSHion (CVE-2024-6387), linking back to 2008-4109
2024-07-01