Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
Summary: On July 1, 2024, a signal handler race condition in OpenSSH servers (sshd) on glibc-based Linux systems was disclosed as CVE-2024-6387, called RegreSSHion, rated High severity (CVSS 8.1) and capable of unauthenticated remote code execution with root privileges. Palo Alto Networks Xpanse data showed over 7 million exposed instances of OpenSSH versions 8.5p1-9.7p1 globally as of July 1, 2024, rising to 7.3 million when older versions (4.3p1 and earlier) are included, though backporting likely makes this an overcount.
What's compelling: Successful exploitation has been shown only on 32-bit Linux/glibc systems and typically requires 6-8 hours of continuous connections under lab conditions, and Palo Alto Networks said it could not achieve remote code execution with the public PoC - but 7.3 million exposed instances is the population an attacker would draw from once a working exploit appears.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-6387
- Related
- Storm⚡Watch: Unplugged - July 9th, 2024 Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026