A signal handler race condition was found in OpenSSH’s server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd’s SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog (). This vulnerability enables remote unauthenticated attackers to execute arbitrary code on the target server, presenting a severe risk to systems that run OpenSSH sshd servers for remote access.

Although the possibility of remote code execution, the complexity to achieve that is very high and time consuming due to the need of winning a race condition. If the attacker doesn’t achieve such a win, the most likely outcome is to have the sshd server crash, generating only the availability impact. To achieve the condition mentioned before a huge number of connections to the targeted server may be needed, which may eventually be easily noticed via network monitoring tools.