regreSSHion (CVE-2024-6387)

When someone connects to sshd but does not log in within LoginGraceTime (120 seconds by default), a timer signal fires and sshd's handler cleans up. That handler called functions such as syslog() that are not safe to run inside a signal handler. If the signal lands at exactly the wrong moment, memory is corrupted, and Qualys showed this can give an unauthenticated attacker root on glibc-based Linux.

The name says the rest: it was a regression. The same bug, CVE-2006-5051, had been fixed in 2006, and a code change in OpenSSH 8.5p1 in October 2020 accidentally removed that protection. Qualys disclosed it on 1 July 2024, the same day OpenSSH 9.8p1 fixed it, and found over 14 million internet-facing OpenSSH servers that might be vulnerable.

Exploiting it is slow and fiddly: the lab exploits worked on 32-bit systems, needed hours of repeated connections and depended on the exact build, and no exploitation in the wild has been confirmed. It is still a perfect lesson in regression testing and in limiting who can reach SSH at all. Check your distribution's package, because many vendors backported the fix without changing the version number.