# RCE vulnerability in OpenSSH: everything you need to know

Signal handler race in OpenSSH sshd's SIGALRM path calls async-unsafe syslog()/malloc(), enabling heap corruption and unauthenticated root RCE on 32-bit glibc Linux.

- Payout: Research
- Severity: critical
- Program: OpenSSH
- Found by (vendor credit): Qualys Threat Research Unit (TRU) (Qualys)
- Write-up by: Wiz Research
- Disclosed: 2024-07-01
- CVE: CVE-2024-6387
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/cve-2024-6387-critical-rce-openssh
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-cve-2024-6387-critical-rce-openssh
- Tags: area:cloud domain:infra impact:privesc impact:rce kind:research platform:threat-intel sev:critical tech:linux technique:regression technique:source-review vuln:memory-corruption vuln:race-condition vuln:rce

**Target:** OpenSSH server (sshd) on 32-bit glibc-based Linux
**Root cause:** When a client fails to authenticate within LoginGraceTime, the SIGALRM handler runs asynchronously and calls non-async-signal-safe functions including syslog(), which in glibc calls malloc()/free(). If interrupted by other heap code, heap corruption results. It is a regression of CVE-2006-5051.
**Steps:**
1. Target an OpenSSH version in the vulnerable ranges (<4.4p1 or 8.5p1–9.8p1) on 32-bit glibc Linux with default config.
2. Open an SSH connection and do not authenticate; wait for LoginGraceTime (120s default) to elapse so SIGALRM fires.
3. The SIGALRM handler calls syslog() -> malloc()/free() asynchronously; arrange timing so it is interrupted by other heap-related code.
4. Repeat attempts (hours of login attempts) to corrupt the heap, then shape the heap to achieve arbitrary code execution as sshd root.
**How found:** Qualys analyzed the SIGALRM handler's call graph and found it invokes async-signal-unsafe syslog(), tracing it to malloc()/free() in glibc; they recognized it as a regression of CVE-2006-5051 reintroduced by later code changes.
**Exploitation:** Unauthenticated attacker repeatedly triggers the SIGALRM race by failing authentication; heap corruption is shaped into arbitrary code execution running with sshd's root privileges. Requires distribution-specific ASLR and glibc struct layouts, and many attempts over hours; only proven in lab on 32-bit Linux/glibc.
**Insight:** Audit signal handlers for async-signal-unsafe calls (syslog, malloc/free) reachable on timeout paths like LoginGraceTime; check whether past fixes were silently regressed by later refactors.