regreSSHion (CVE-2024-6387): The Ghost of 2006 Returns for Root
Jan 5, 2026·5 min read·17 visits
Executive Summary (TL;DR)
OpenSSH's `sshd` has a signal handler race condition. If a client doesn't authenticate within `LoginGraceTime` (default 120s), `SIGALRM` is raised. The handler calls `syslog()`, which is not async-signal-safe. If this interrupts a heap operation (like `free()`) in the main thread, it corrupts the heap. Attackers can win this race to gain unauthenticated root RCE.
A signal handler race condition in OpenSSH's server (sshd) on glibc-based Linux systems allows unauthenticated remote code execution as root. This is a regression of a vulnerability originally fixed in 2006 (CVE-2006-5051), reintroduced via code refactoring.
Official Patches
Fix Analysis (1)
Technical Appendix
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HAffected Systems
Affected Versions Detail
| Product | Affected Versions | Fixed Version |
|---|---|---|
OpenSSH OpenBSD | >= 8.5p1, < 9.8p1 | 9.8p1 |
| Attribute | Detail |
|---|---|
| CWE ID | CWE-364 (Signal Handler Race Condition) |
| CVSS v3.1 | 8.1 (High) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Exploit Status | Proof of Concept Available |
MITRE ATT&CK Mapping
The software handles a signal in a way that causes a race condition or other unsafe behavior, often leading to memory corruption or deadlock.
Known Exploits & Detection
Vulnerability Timeline
Subscribe to updates
Get the latest CVE analysis reports delivered to your inbox.