Race Condition Vulnerability in OpenSSH (CVE-2024-6387): PoC Exploit Released  

OpenSSH is a suite of networking utilities based on the Secure Shell (SSH) protocol. It is extensively used for secure remote login, remote server management and administration, and file transfers via SCP and SFTP. OpenSSH server process ‘sshd’ is affected by a signal handler race condition allowing unauthenticated remote code execution with root privileges on glibc-based Linux systems.

Summary 

Application	OpenSSH
Severity	High
CVSS	8.1
CVEs	CVE-2024-6387
Exploited in Wild	Yes
Patch/Remediation Available	Yes
Advisory Version	1.0

Overview 

CVE-2024-6387, a high-severity vulnerability in OpenSSH’s server (sshd), has been identified and is currently being exploited in the wild. Known as “regreSSHion,” this flaw involves a sophisticated race condition during the authentication phase, allowing unauthenticated remote attackers to execute arbitrary code with root privileges.

A proof-of-concept (PoC) exploit for this critical vulnerability has been released, further raising concerns. 

The vulnerability affects millions of OpenSSH servers globally, with older versions particularly at risk. Rated with a CVSS score of 8.1, the flaw poses a significant security threat. Over 14 million OpenSSH server instances exposed to the Internet have been identified as potentially vulnerable, with around 700,000 instances facing external internet threats. 

Vulnerability Name	CVE ID	Product Affected	Severity	Fixed Version
Race Condition vulnerability	CVE-2024-6387	OpenSSH (8.5p1–9.8p1)	High	OpenSSH 9.8p2 or later

Technical Summary 

CVE-2024-6387, also known as “regreSSHion,” is a critical vulnerability in OpenSSH’s server (sshd) caused by a signal handler race condition. This issue arises when the SIGALRM handler, triggered during a failed login attempt exceeding LoginGraceTime, invokes non-async-signal-safe functions like syslog(). The Vulnerability allows unauthenticated remote attackers to execute arbitrary code with root privileges, primarily affecting glibc-based Linux systems.

Exploitation is technically complex but feasible and has been demonstrated in controlled environments on 32-bit systems. OpenBSD systems are unaffected due to their different signal-handling mechanisms. 

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2024-6387	OpenSSH v8.5p1 through 9.8p1 on glibc-based Linux systems	Signal handler race condition in sshd’s SIGALRM, triggered during login timeout (LoginGraceTime).	Remote Code Execution (Root Privileges)

Impact:

This Vulnerability if exploited could lead to complete system takeover.

Remediation: 

• Immediate Patch: Upgrade OpenSSH to version 9.8p2 or later, which resolves the issue. 

• Access Restrictions: Implement firewall rules or TCP wrappers to limit SSH access to trusted IP ranges. 

• Monitor Activity: Use intrusion detection systems (IDS) to analyze logs for unusual activity, failed login attempts, or exploitation patterns. 

Indicators of Compromise (IOCs): 

IP Address / Hostname	File Hash
209.141.53[.]247	0df799f05c6d97e2b7d4b26c8e7246f7
108.174.58[.]28	11cc5f00b466d4f9be4e0a46f2eb51ae
195.85.205[.]47	1f452448cea986aedc88ba50d48691f7
62.72.191[.]203	207eb58423234306edaecb3ec89935d8
botbot.ddosvps.cc

Below are some IOCs associated with the threat. For a complete list of IOCs, refer to the AlienVault Pulse for CVE-2024-6387 

Conclusion: 

The public release of a PoC exploit for CVE-2024-6387 marks a critical moment for organizations relying on OpenSSH. While exploitation requires significant effort, the potential impact of a successful attack—complete system compromise and privilege escalation—is severe.

Swift patching and the adoption of layered security measures are imperative to mitigate the risks. 

Organizations must act promptly to safeguard their systems and monitor for signs of active exploitation. By staying informed and proactive, businesses can minimize the potential fallout from this serious vulnerability. 

References: 

• https://cybersecuritynews.com/regresshion-code-execution-vulnerability/  

• https://exploitfinder.com/dbexploit/exploit.html?id=CVE-2024-6387&type=GitAI&returnTab=github-ai  

• https://nvd.nist.gov/vuln/detail/cve-2024-6387 
• https://www.yorku.ca/uit/2025/01/openssh-remote-code-execution-regresshion-cve-2024-6387/