We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-6387

Openssh: regresshion - race condition in ssh allows rce/dos



Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Reserved 2024-06-27 | Published 2024-07-01 | Updated 2025-04-24 | Assigner redhat


HIGH: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

Signal Handler Race Condition

Product status

Default status
unaffected

8.5p1
affected

Default status
affected

0:8.7p1-38.el9_4.1 before *
unaffected

Default status
affected

0:8.7p1-38.el9_4.1 before *
unaffected

Default status
affected

0:8.7p1-12.el9_0.1 before *
unaffected

Default status
affected

0:8.7p1-30.el9_2.4 before *
unaffected

Default status
affected

413.92.202407091321-0 before *
unaffected

Default status
affected

414.92.202407091253-0 before *
unaffected

Default status
affected

415.92.202407091355-0 before *
unaffected

Default status
affected

416.94.202407081958-0 before *
unaffected

Default status
unaffected

Default status
affected

Default status
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2024-06-27:Reported to Red Hat.
2024-07-01:Made public.

Credits

Red Hat would like to thank Qualys Threat Research Unit (TRU) (Qualys) for reporting this issue.

References

access.redhat.com/errata/RHSA-2024:4312 (RHSA-2024:4312) vendor-advisory

access.redhat.com/errata/RHSA-2024:4340 (RHSA-2024:4340) vendor-advisory

access.redhat.com/errata/RHSA-2024:4389 (RHSA-2024:4389) vendor-advisory

access.redhat.com/errata/RHSA-2024:4469 (RHSA-2024:4469) vendor-advisory

access.redhat.com/errata/RHSA-2024:4474 (RHSA-2024:4474) vendor-advisory

access.redhat.com/errata/RHSA-2024:4479 (RHSA-2024:4479) vendor-advisory

access.redhat.com/errata/RHSA-2024:4484 (RHSA-2024:4484) vendor-advisory

access.redhat.com/security/cve/CVE-2024-6387 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2294604 (RHBZ#2294604) issue-tracking

santandersecurityresearch.github.io/...shing_the_masses.html

www.openssh.com/txt/release-9.8

www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

cve.org (CVE-2024-6387)

nvd.nist.gov (CVE-2024-6387)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2024-6387

Support options

Helpdesk Chat, Email, Knowledgebase