OpenSSH regreSSHion — RCE بدون احراز هویت

regreSSHion is a critical unauthenticated remote code execution vulnerability in OpenSSH server (sshd), rediscovering a regression of the previously patched CVE-2006-5051.

## Vulnerability Overview
A race condition in the signal handler of sshd allows an unauthenticated attacker to execute arbitrary code as root on glibc-based Linux systems. The vulnerability is triggered when a client fails to authenticate within the LoginGraceTime window, causing sshd to call async-signal-unsafe functions in the SIGALRM handler.

## Technical Details
- **Type:** Race Condition / Signal Handler Misuse (CWE-362)
- **Root Cause:** The SIGALRM handler calls `syslog()` and other async-signal-unsafe functions. By timing the connection to race the signal, an attacker can corrupt heap memory and achieve code execution.
- **Exploitation Difficulty:** High — requires ~10,000 attempts on average due to ASLR. Exploitation takes minutes to hours depending on system configuration.
- **Affected Architectures:** x86-64 (32-bit is theoretically possible but not demonstrated)

## Real-World Impact
- Qualys Research Team discovered and responsibly disclosed this vulnerability.
- Estimated 14 million internet-exposed OpenSSH instances vulnerable.
- Full root RCE achieved in lab conditions; weaponized exploits circulating in underground forums.

## Affected Versions
- OpenSSH < 4.4p1 (original CVE-2006-5051)
- OpenSSH 8.5p1 – 9.7p1 (regression reintroduced)
- Fixed in OpenSSH 9.8p1