CVE-2024-6387
Openssh: regresshion - race condition in ssh allows rce/dos
HIGH 8.1
At a glance
- Source
- NVD
- EPSS
- EPSS 99.51 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Weaknesses (CWE)
- CWE-364 — Signal Handler Race Condition
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
References
- https://access.redhat.com/errata/RHSA-2024:4312
- https://access.redhat.com/errata/RHSA-2024:4340
- https://access.redhat.com/errata/RHSA-2024:4389
- https://access.redhat.com/errata/RHSA-2024:4469
- https://access.redhat.com/errata/RHSA-2024:4474
- https://access.redhat.com/errata/RHSA-2024:4479
- https://access.redhat.com/errata/RHSA-2024:4484
- https://access.redhat.com/security/cve/CVE-2024-6387
- https://bugzilla.redhat.com/show_bug.cgi?id=2294604
- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
- https://www.openssh.com/txt/release-9.8
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
- https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
- https://www.exploit-db.com/exploits/52269
- https://packetstorm.news/files/id/190587/
- http://www.openwall.com/lists/oss-security/2024/07/01/12
- http://www.openwall.com/lists/oss-security/2024/07/01/13
- http://www.openwall.com/lists/oss-security/2024/07/02/1
- http://www.openwall.com/lists/oss-security/2024/07/03/1
- http://www.openwall.com/lists/oss-security/2024/07/03/11
- http://www.openwall.com/lists/oss-security/2024/07/03/2
- http://www.openwall.com/lists/oss-security/2024/07/03/3
- http://www.openwall.com/lists/oss-security/2024/07/03/4
- http://www.openwall.com/lists/oss-security/2024/07/03/5
- http://www.openwall.com/lists/oss-security/2024/07/04/1
- http://www.openwall.com/lists/oss-security/2024/07/04/2
- http://www.openwall.com/lists/oss-security/2024/07/08/2
- http://www.openwall.com/lists/oss-security/2024/07/08/3
- http://www.openwall.com/lists/oss-security/2024/07/09/2
- http://www.openwall.com/lists/oss-security/2024/07/09/5
- http://www.openwall.com/lists/oss-security/2024/07/10/1
- http://www.openwall.com/lists/oss-security/2024/07/10/2
- http://www.openwall.com/lists/oss-security/2024/07/10/3
- http://www.openwall.com/lists/oss-security/2024/07/10/4
- http://www.openwall.com/lists/oss-security/2024/07/10/6
- http://www.openwall.com/lists/oss-security/2024/07/11/1
- http://www.openwall.com/lists/oss-security/2024/07/11/3
- http://www.openwall.com/lists/oss-security/2024/07/23/4
- http://www.openwall.com/lists/oss-security/2024/07/23/6
- http://www.openwall.com/lists/oss-security/2024/07/28/2
- http://www.openwall.com/lists/oss-security/2024/07/28/3
- https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
- https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
- https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
- https://explore.alas.aws.amazon.com/CVE-2024-6387.html
- https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132
- https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc
- https://github.com/AlmaLinux/updates/issues/629
- https://github.com/Azure/AKS/issues/4379
- https://github.com/PowerShell/Win32-OpenSSH/discussions/2248
- +31 more
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-47981
- GCVE · GCVE-0-2024-6387
CERT-FR advisories
- CERTFR-2026-AVI-0471 — Multiples vulnérabilités dans Oracle Systems · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0492 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0486 — Multiples vulnérabilités dans les produits Qnap · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0018 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0003 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0811 — Multiples vulnérabilités dans les produits Trend Micro · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0780 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0750 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0713 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0666 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0657 — Multiples vulnérabilités dans les produits HPE Aruba Networking · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0651 — Vulnérabilité dans les produits Trend Micro · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0650 — Multiples vulnérabilités dans Stormshield Management Center · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0649 — Vulnérabilité dans les produits Citrix · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0648 — Multiples vulnérabilités dans les produits SonicWall · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0643 — Vulnérabilité dans les produits Moxa · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0634 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0584 — Vulnérabilité dans les produits Cisco · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0583 — Vulnérabilité dans les produits Kaspersky · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0579 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0573 — Vulnérabilité dans les produits Microsoft · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0539 — Vulnérabilité OpenSSH dans des systèmes d'exploitation · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0531 — Multiples vulnérabilités dans OpenSSH · cert.ssi.gouv.fr
- CERTFR-2024-ALE-009 — Vulnérabilité dans OpenSSH · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:sonicwall:sma_6200_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:sonicwall:sma_7200_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*≥ 4.32.0 ≤ 4.32.1fcpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*cpe:2.3:o:sonicwall:sma_6210_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:sonicwall:sma_7210_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:sonicwall:sma_8200v_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:sonicwall:sra_ex_7000_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a9500_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*≥ 12.0 < 12.7.6cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*≥ 13.0 < 13.6.8cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*≥ 14.0 < 14.6cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*< 4.4cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*≥ 8.6 ≤ 9.8cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:8.6:-:*:*:*:*:*:*- +52 more
Affected products
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |