https://www.suse.com/security/cve/CVE-2024-6387.html https://www.qualys.com/regresshion-cve-2024-6387/ The regreSSHion Bug An Unauthenticated Remote Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) on glibc-based Linux systems. What is regreSShion? regreSSHion, CVE-2024-6387, is an unauthenticated remote code execution in OpenSSH’s server (sshd) that grants full root access. It affects the default configuration and does not require user interaction. It poses a significant exploit risk. https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshi... The Qualys Threat Research Unit (TRU) has discovered a Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387. https://nvd.nist.gov/vuln/detail/CVE-2024-6387 CVE-2024-6387 Detail Awaiting Analysis This vulnerability is currently awaiting analysis. Description A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387 https://access.redhat.com/security/cve/cve-2024-6387 https://security-tracker.debian.org/tracker/CVE-2024-6387 https://www.kaspersky.com/blog/openssh-vulnerability-mitigation-cve-2024-638... https://vulcan.io/blog/cve-2024-6387-how-to-fix-regresshion-vulnerability/ https://www.phoronix.com/news/RegreSSHion-CVE-2024-6387 https://www.phoronix.com/forums/forum/software/general-linux-open-source/147...