The vulnerability, tracked as CVE-2024-6387, is a signal handler race condition in the sshd component. Qualys researchers found it can lead to unauthenticated remote code execution with root privileges. The issue is a regression of a bug originally patched in 2006.
Exploitation requires many connection attempts because the race condition must be won within a narrow time window. Qualys demonstrated that the attack can take several hours on 32 bit systems but can be faster on high performance hardware. Successful exploitation does not require authentication.
Patches are available from major Linux distributions and OpenBSD. Administrators should update OpenSSH immediately or set LoginGraceTime to zero as a temporary mitigation. Network monitoring for many failed SSH connections can help detect attempts.