OpenSSH "regreSSHion" remote code execution (CVE-2024-6387)

Summary

Researchers disclosed a race condition in OpenSSH’s sshd that can lead to unauthenticated remote code execution with root privileges on glibc-based Linux systems. Exploitation is difficult and requires many connection attempts, but the impact — full server compromise — makes this a priority for any host exposing SSH to untrusted networks.

Who is affected

Any GARNET member operating a Linux server with an internet-reachable sshd in the affected version range. Hosts behind strict network controls that restrict SSH to known management networks are at substantially lower risk, but should still be patched.

Recommended actions

1. Update OpenSSH to a fixed release (9.8p1 or later), or apply your distribution’s backported patch. On Debian/Ubuntu: sudo apt update && sudo apt install --only-upgrade openssh-server.
2. Restrict exposure. Limit SSH to trusted source networks with a firewall or security group, and prefer a bastion/jump host over direct exposure.
3. Mitigate if you cannot patch immediately. Setting LoginGraceTime 0 in sshd_config removes the race window, but note it enables a denial-of-service condition — treat it as a temporary measure only.
4. Restart sshd after updating and confirm the running version with ssh -V and sshd -V.

Reporting

If you believe a server in the community has been compromised via this issue, report an incident to GARNET CSIRT immediately.

Think a system in the community is affected or compromised?Report an incident