regreSSHion OpenSSH Flaw Exposes sshd to Unauthenticated Remote Code Execution
A high-severity vulnerability tracked as CVE-2024-6387 has been disclosed in OpenSSH sshd, where a race condition in signal handling can let a remote, unauthenticated attacker trigger remote code execution or cause a denial of service by precisely timing a timeout during authentication. The bug, widely referred to as regreSSHion, affects OpenSSH versions 8.5p1 through 9.7p1 and revives a class of weakness in one of the most widely deployed remote administration services on Linux and Unix-like systems.
Reports said the exposure could affect roughly 700,000 Linux systems, underscoring the internet-facing risk for organizations that rely on SSH for remote access. OpenSSH 9.8 and later include a fix, and vendors including Red Hat have issued advisories for impacted deployments, prompting defenders to identify exposed sshd instances, prioritize patching, and review compensating controls for externally reachable SSH services.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
2 events from the most recent confirmed update back to the earliest known activity.
OpenSSH 9.8 and vendor advisories address CVE-2024-6387
OpenSSH 9.8 and later were identified as containing fixes for CVE-2024-6387, and vendors including Red Hat published advisories to address the vulnerability. Public reporting on July 1, 2024 also highlighted the bug's broad exposure, with one report estimating impact on around 700,000 Linux systems.
OpenSSH regression flaw CVE-2024-6387 affects versions 8.5p1 to 9.7p1
A race condition in OpenSSH sshd signal handling introduced a vulnerability later tracked as CVE-2024-6387, allowing a remote unauthenticated attacker to potentially achieve remote code execution or cause denial of service. The issue affected OpenSSH versions 8.5p1 through 9.7p1.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
CVE-2024-6387 | High Severity | Armis
cve.armis.com
Open sourceArch Linux - News: The sshd service needs to be restarted after upgrading to openssh-9.8p1
archlinux.org
Open source[Security Issue] hpn-ssh seems be to vulnerable to a critical threat CVE-2024-6387 · Issue #87 · rapier1/hpn-ssh
github.com
Open sourceNasty regreSSHion bug affects around 700K Linux systems
theregister.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical OpenShift and OpenSSH Flaws Expose Linux Systems to Root Access
Authorities warned that **Red Hat OpenShift Container Platform 4** contains two high-severity vulnerabilities that can lead to code execution and node takeover in enterprise container environments. `CVE-2024-45496` in `ose-openshift-controller-manager-container` carries a **CVSS 9.9** rating and can allow arbitrary code execution on an OpenShift node when a user with developer-level access exploits insufficient restrictions on elevated privileges. `CVE-2024-7387` in `openshift4/ose-docker-builder`, rated **CVSS 9.1**, can enable arbitrary command execution on an OpenShift node and may allow privilege escalation and full control of the affected node. At the time of the alert, mitigations were available but vendor patches had not yet been released. A separate alert highlighted the **regreSSHion** flaw in **OpenSSH**, which can give an attacker unrestricted root-level access on vulnerable Linux and FreeBSD-based systems. The issue affects OpenSSH versions from `8.5p1` up to but not including `9.8p1`, as well as versions earlier than `4.4p1`; OpenBSD-based systems were reported as not vulnerable. Successful exploitation has been confirmed on systems using **glibc**, while systems using **musl libc** were reported as not vulnerable, and the attack currently requires repeated attempts over hours or days. A fix is available in **OpenSSH `9.8p1`**, though some distributors have backported the patch, meaning package version numbers alone may not reliably indicate exposure.
Jun 29, 2026
OpenSSH GSSAPI Key Exchange Flaw Exposes Systems to DoS and Information Disclosure
A flaw in OpenSSH's GSSAPI key exchange handling was disclosed on the `oss-security` mailing list and later tracked as **CVE-2026-3497**, with Red Hat describing the issue as an information disclosure or denial-of-service condition caused by uninitialized variables. The bug affects OpenSSH deployments that use GSSAPI authentication or key exchange, where improper handling of internal state can allow an attacker to trigger crashes or expose unintended memory contents under certain conditions. Vendor tracking shows the issue moved from public disclosure into downstream remediation, with Red Hat opening Bugzilla case `2447085` for affected products. Separate references to Oracle Linux and a SonicWall advisory indicate vendors were also assessing or mapping related OpenSSH exposure in their own ecosystems, underscoring that the impact extends beyond a single distribution and requires organizations using GSSAPI-enabled SSH services to review patches and product advisories promptly.
Jul 2, 2026
Linux Kernel CVE-2026-46333 Exposes SSH Keys and Enables Local Root Escalation
Researchers and vendors disclosed **CVE-2026-46333**, a Linux kernel flaw in `__ptrace_may_access()` that lets an unprivileged local user exploit a process-exit race to bypass authorization checks and steal file descriptors from privileged processes. The bug has existed since Linux `v4.10-rc1`, and exploitation became more practical with `pidfd_getfd()` introduced in `v5.6-rc1`. Qualys and public proof-of-concept authors showed the issue can expose `/etc/shadow`, leak OpenSSH host private keys through `ssh-keysign`, and in some cases execute commands as root via targets including `chage`, `pkexec`, and `accounts-daemon` on default Debian, Ubuntu, Fedora, AlmaLinux, and other distributions. Linus Torvalds merged the upstream fix in commit `31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a`, and stable kernel updates were released across multiple branches as distributions began shipping patched packages. Public exploit code appeared almost immediately after the fix became visible, increasing the urgency for defenders to patch and reboot affected systems, rotate potentially exposed **SSH host keys** and other credentials, and review systems for local privilege-escalation activity. Where immediate patching is not possible, several vendors and Qualys said raising `kernel.yama.ptrace_scope` to `2` or `3` can block known exploit paths, although maintainers cautioned that such settings are only a temporary workaround and may disrupt debugging tools.
Jun 29, 2026