regreSSHion: OpenSSH sshd CVE-2024-6387 (signal handler race condition, unauthenticated, root code execution): which versions are affected and how do I fix it?

What it is: CVE-2024-6387, nicknamed regreSSHion, is a race condition in the OpenSSH server (sshd) where a signal handler runs unsafely when a client fails to authenticate within the login grace time. It is a regression of the older CVE-2006-5051 and was reported by Qualys; OpenSSH published the fix on July 1, 2024. It may allow code execution as root. OpenSSH reports a demonstration on 32-bit Linux/glibc with ASLR required several hours of continuous connections in lab conditions; 64-bit exploitation is believed possible but was not demonstrated. It is not listed here as a KEV entry. Am I affected: - Portable OpenSSH sshd 8.5p1 through 9.7p1 inclusive (OpenSSH release notes). OpenBSD is not vulnerable. NVD notes older ranges can matter where earlier fixes were not present. - Many distributions backport the fix without changing the upstream version number, so check your vendor advisory (Red Hat, Ubuntu, Debian, SUSE, Apple, FreeBSD and others are listed in NVD references). Check: ssh -V on the server and your package changelog. Fix: 1. Install your distribution's updated openssh-server package, or upgrade to OpenSSH 9.8 or later. 2. Restart sshd after the update (systemctl restart ssh or sshd). Existing sessions are unaffected by restart. 3. Reduce exposure meanwhile: restrict SSH to VPN or allow-listed addresses and use firewall rate limiting for connection attempts. Qualys and your vendor may publish further configuration mitigations; follow your vendor advisory. 4. Look for unexpected sshd crashes or restarts and repeated connections that time out; if you see signs of compromise, rebuild the host and rotate its keys and secrets. Verify: the package version matches the vendor's fixed build (or ssh -V shows 9.8 or later) and sshd was restarted. Sources: https://www.openssh.org/txt/release-9.8 https://nvd.nist.gov/vuln/detail/CVE-2024-6387