Description
Signal handler race condition in OpenSSH before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code if GSSAPI authentication is enabled, via unspecified vectors that lead to a double-free.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssh | 1:4.6p1-1 | — |
| Debian 13 | openssh | 1:4.6p1-1 | — |
| Debian 12 | openssh | 1:4.6p1-1 | — |
| Debian 4.0 | openssh | 1:4.3p2-9etch3 | DSA-1638-1 |
| Debian 3.1 | openssh | 1:3.8.1p1-8.sarge.6 | DSA-1212-1 |
| Debian 3.1 | openssh-krb5 | 3.8.1p1-7sarge1 | DSA-1189-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | openssh +4 | 3.9p1-8.RHEL4.17 | RHSA-2006:0697 |
| RHEL 3 | openssh +4 | 3.6.1p2-33.30.12 | RHSA-2006:0697 |
| RHEL 2 | openssh +4 | 3.1p1-21 | RHSA-2006:0698 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
bigb0x/CVE-2024-6387 ★ 35 · Jul 1, 2024
Bulk Scanning Tool for OpenSSH CVE-2024-6387, CVE-2006-5051 , CVE-2008-4109 and others.
-
anhvutuan/CVE-2024-6387-poc-1 ★ 2 · Oct 22, 2024
CVE-2024-6387, also known as RegreSSHion, is a high-severity vulnerability found in OpenSSH servers (sshd) running on glibc-based Linux systems. It is a regression of a previously fixed vulnerability…
-
sardine-web/CVE-2024-6387_Check ★ 0 · Jul 4, 2024
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remot…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2006:0697 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0698 Red Hat Security Advisory: openssh security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1638-1 openssh - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1212-1 openssh Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1189-1 openssh-krb5 Debian Security (DSA / DLA) · Mar 9, 2026
- NCSC-2024-0362 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Sep 10, 2024
- NCSC-2024-0272 Kwetsbaarheid verholpen in OpenSSH NCSC-NL (Netherlands) · Jul 1, 2024
References
- FreeBSD-SA-06:22 vendor-advisory
- http://sourceforge.net/forum/forum.php?forum_id=681763
- 22270 third-party-advisory
- http://www.arkoon.fr/upload/alertes/43AK-2006-09-FR-1.0_SSL360_OPENSSH.pdf
- USN-355-1 vendor-advisory
- [freebsd-security] 20061002 FreeBSD Security Advisory FreeBSD-SA-06:22.openssh mailing-list
- http://www.vmware.com/support/vi3/doc/esx-3069097-patch.html
- oval:org.mitre.oval:def:11387 vdb-entry signature
- http://openssh.org/txt/release-4.4
- 24805 third-party-advisory
- VU#851340 third-party-advisory
- [2.9] 015: SECURITY FIX: October 12, 2006 vendor-advisory
- 22487 third-party-advisory
- TA07-072A third-party-advisory
- http://www.arkoon.fr/upload/alertes/36AK-2006-07-FR-1.0_FAST360_OPENSSH.pdf
- GLSA-200611-06 vendor-advisory
- SUSE-SA:2006:062 vendor-advisory
- 22362 third-party-advisory
- 23680 third-party-advisory
- APPLE-SA-2007-03-13 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305214
- 22352 third-party-advisory
- ADV-2006-4329 vdb-entry
- 22236 third-party-advisory
- 24799 third-party-advisory
- ADV-2006-4018 vdb-entry
- 22495 third-party-advisory
- openssh-signal-handler-race-condition(29254) vdb-entry
- 20241 vdb-entry
- ADV-2007-1332 vdb-entry
- 29264 vdb-entry
- 22823 third-party-advisory
- SSA:2006-272-02 vendor-advisory
- RHSA-2006:0697 vendor-advisory
- OpenPKG-SA-2006.022 vendor-advisory
- 22183 third-party-advisory
- [openssh-unix-dev] 20060927 Announce: OpenSSH 4.4 released mailing-list
- ADV-2007-0930 vdb-entry
- [security-announce] 20070409 Globus Security Advisory 2007-02: GSI-OpenSSH vulnerability mailing-list
- 22926 third-party-advisory
- 22173 third-party-advisory
- 1016940 vdb-entry
- 22208 third-party-advisory
- http://www.vmware.com/support/vi3/doc/esx-9986131-patch.html
- 22245 third-party-advisory
- 22196 third-party-advisory
- DSA-1212 vendor-advisory
- RHSA-2006:0698 vendor-advisory
- 22158 third-party-advisory
- MDKSA-2006:179 vendor-advisory
- DSA-1189 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-216.htm
- 24479 third-party-advisory
- [oss-security] 20240701 CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems mailing-list
- [oss-security] 20240728 Re: Announce: OpenSSH 9.8 released mailing-list
- https://www.openwall.com/lists/oss-security/2024/07/28/3