regreSSHion: update OpenSSH on your Linux servers

A critical OpenSSH bug can give root without a password on many Linux servers. Check your version.

9 July 2024 · 1 min read

Last week Qualys published regreSSHion (CVE-2024-6387): a bug in OpenSSH’s server that can let an attacker run code as root, without logging in, on Linux systems using glibc. It’s an old bug that came back in a 2020 change, hence the name.

Affected: OpenSSH from 8.5p1 up to 9.7p1. Fixed in 9.8p1, and distributions have shipped patched packages.

Check:

ssh -V

Then update through your package manager. Your distribution may backport the fix without changing the version number, so trust its security advisory over the number you see.

The good news: exploiting it is slow and hard. It takes many hours of attempts, and it was only shown working on 32-bit systems. The bad news: attackers have time, and servers stay unpatched for years.

If you can’t update today, setting LoginGraceTime 0 in sshd_config blocks the attack, at the cost of making it easier to tie up connections. And better still: don’t leave SSH open to the whole internet in the first place.