RegreSSHion

RegreSSHion is a family of security bugs in the OpenSSH software that allows for an attacker to remotely execute code and gain potential root access on a machine running the OpenSSH Server. The vulnerability was discovered by the Qualys Threat Research Unit and was disclosed on July 1st, 2024. It affected all prior versions of OpenSSH from 8.5p1 (March 3rd, 2021) to 9.7p1 (March 11th, 2024) and was patched in release 9.8/9.8p1 on July 1st, 2024. Qualys reported identifying over 14 million public facing OpenSSH instances potentially vulnerable to the attack. It affects glibc-based Linux systems; Windows and OpenBSD systems are not vulnerable to the attack.

Disclosure
The vulnerability was publicly disclosed by Qualys on July 1st, 2024. Qualys reported disclosing the vulnerability to the OpenSSH developers on May 19th, approximately two months prior, and reported notifying OpenWall on June 20th, 2024.

Vulnerability
The regreSSHion vulnerability in OpenSSH results from a signal handler race condition in its server component (sshd). This issue is triggered when a client fails to authenticate within the LoginGraceTime period (default 120 seconds). When this timeout occurs, sshd's SIGALRM handler is called asynchronously, invoking functions that are not safe to use in signal handlers, such as syslog. In versions < 4.4p1, an attacker could exploit the  function during   within the signal handler. However, in versions from 8.5p1 to 9.7p1, both the  and   functions are targeted.

This vulnerability is a regression of CVE-2006-5051, reintroduced in OpenSSH 8.5p1 (October 2020) due to the accidental removal of a crucial directive that had mitigated the earlier vulnerability. The directive transformed unsafe calls into a safe _exit(1) call.

Terminology
According to Qualys, the bug was named "regreSSHion" as a reference to a regression bug affecting OpenSSH.