8.1Hoch

CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos

OpenSSH; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Red Hat Enterprise Linux 9.2 Exten… Veröffentlicht: 2024-07-01 15:37 (vor 2 Jahren)

Beschreibung

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Schwachstellentyp (CWE): CWE-364 CWE-362

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
almalinux	almalinux	9.0
amazon	amazon linux	2023.0
apple	macos	12.0 – < 12.7.6
arista	eos	4.32.0 – ≤ 4.32.1f
canonical	ubuntu linux	23.10
debian	debian linux	12.0
enterprise linux	9	—
freebsd	freebsd	13.2
netapp	500f firmware	—
netapp	8300 firmware	—
netapp	8700 firmware	—
netapp	a150 firmware	—
netapp	a1k firmware	—
netapp	a220 firmware	—
netapp	a250 firmware	—
netapp	a400 firmware	—
netapp	a70 firmware	—
netapp	a700s firmware	—
netapp	a800 firmware	—
netapp	a90 firmware	—
netapp	a900 firmware	—
netapp	a9500 firmware	—
netapp	active iq unified manager	—
netapp	bootstrap os	—
netapp	c190 firmware	—
netapp	c250 firmware	—
netapp	c400 firmware	—
netapp	c800 firmware	—
netapp	e-series santricity os controller	11.0.0 – ≤ 11.70.2
netapp	fas2720 firmware	—
netapp	fas2750 firmware	—
netapp	fas2820 firmware	—
netapp	ontap	9
netapp	ontap select deploy administration utility	—
netapp	ontap tools	9
netbsd	netbsd	≤ 10.0.0
openbsd	openssh	< 4.4
openshift	4.13	—
openshift	4.14	—
openshift	4.15	—
openshift	4.16	—
redhat	enterprise linux	9.0
redhat	enterprise linux eus	9.4
redhat	enterprise linux for arm 64	9.0_aarch64
redhat	enterprise linux for arm 64 eus	9.4_aarch64
redhat	enterprise linux for ibm z systems	9.0_s390x
redhat	enterprise linux for ibm z systems eus	9.4_s390x
redhat	enterprise linux for power little endian	9.0_ppc64le
redhat	enterprise linux for power little endian eus	9.4_ppc64le
redhat	enterprise linux server aus	9.4
redhat	openshift container platform	4.0
Red Hat	Red Hat Ceph Storage 5	—
Red Hat	Red Hat Ceph Storage 6	—
Red Hat	Red Hat Ceph Storage 7	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	all versions
Red Hat	Red Hat OpenShift Container Platform 4	all versions
Red Hat	Red Hat OpenShift Container Platform 4.13	all versions
Red Hat	Red Hat OpenShift Container Platform 4.14	all versions
Red Hat	Red Hat OpenShift Container Platform 4.15	all versions
Red Hat	Red Hat OpenShift Container Platform 4.16	all versions
rhel e4s	9.0	—
rhel eus	9.2	—
Siemens	Industrial Edge Management OS (IEM-OS)	0
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5
Siemens	SINAMICS IIoT module	< V1.0 HF1
Siemens	SINEMA Remote Connect Server	< V3.2 SP2
Siemens	SINUMERIK ONE	< V6.24
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5
sonicwall	sma 6200 firmware	—
sonicwall	sma 6210 firmware	—
sonicwall	sma 7200 firmware	—
sonicwall	sma 7210 firmware	—
sonicwall	sma 8200v firmware	—
sonicwall	sra ex 7000 firmware	—
suse	linux enterprise micro	6.0
—	OpenSSH	8.5p1 – ≤ 9.7p1

Referenzen und Patches

RHSA-2024:4312 vendor-advisoryThird Party Advisory
RHSA-2024:4340 vendor-advisoryThird Party Advisory
RHSA-2024:4389 vendor-advisoryThird Party Advisory
RHSA-2024:4469 vendor-advisoryThird Party Advisory
RHSA-2024:4474 vendor-advisoryThird Party Advisory
RHSA-2024:4479 vendor-advisoryThird Party Advisory
RHSA-2024:4484 vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387 vdb-entryThird Party Advisory
RHBZ#2294604 issue-trackingThird Party Advisory
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html ExploitThird Party Advisory
https://www.openssh.com/txt/release-9.8 Release NotesThird Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt ExploitThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List
http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/11 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing ListPatch
http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/04/2 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/08/2 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/08/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/09/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/09/5 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/10/1 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/10/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/6 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/11/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/11/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/23/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/23/6 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/28/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/28/3 Mailing List
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Third Party Advisory
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Press/Media CoverageThird Party Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-ex… Press/Media CoverageThird Party Advisory
https://explore.alas.aws.amazon.com/CVE-2024-6387.html Third Party Advisory
https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 Issue Tracking
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Release Notes
https://github.com/AlmaLinux/updates/issues/629 Issue Tracking
https://github.com/Azure/AKS/issues/4379 Issue Tracking
https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking
https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking
https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking
https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 Patch
https://github.com/oracle/oracle-linux/issues/149 Issue Tracking
https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking
https://github.com/zgzhang/cve-2024-6387-poc Third Party Advisory
https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ Third Party Advisory
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Mailing ListRelease Notes
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing ListPatch
https://news.ycombinator.com/item?id=40843778 Issue TrackingPatch

CPE-Treffer (NVD) (60)

cpe:2.3:o:sonicwall:sma_6200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_7200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.32.0 ≤ 4.32.1f
cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*
cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_6210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_7210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_8200v_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sra_ex_7000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a9500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 12.0 < 12.7.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 13.0 < 13.6.8
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 14.0 < 14.6
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* < 4.4
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* ≥ 8.6 ≤ 9.8
cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.6:-:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*
cpe:2.3:o:amazon:amazon_linux:2023.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.70.2
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

CVSS-Score

8.1Hoch

Quelle: redhat · CVSS 3.1

Angriffsvektor: Netzwerk
Komplexität: Hoch
Rechte erforderlich: Keine
Benutzerinteraktion: Keine
Geltungsbereich: Unverändert
Vertraulichkeit: Hoch
Integrität: Hoch
Verfügbarkeit: Hoch

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Alle Scores (3)

cna	CVSS 3.1	8.1Hoch
secalert@redhat.com	CVSS 3.1	8.1Hoch
nvd	CVSS 3.1	8.1Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

99.51%

höher als 100 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: no
Technische Auswirkung: total

Zeitverlauf

ID reserviert2024-06-27
Veröffentlicht2024-07-01 15:37
Bei IP-DB eingegangen2026-10-24 23:25
Zuletzt aktualisiert2026-11-07 00:17

Vergeben von (CNA): redhat
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Ubuntu 22.04 LTS

7.7Hoch

CVE-2026-109518 vor 7 Tagen

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.8Hoch

CVE-2026-114148 vor 13 Tagen

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

Ohne Score

CVE-2026-98912 vor 19 Tagen

ALSA: seq: oss: Reject reads that cannot fit the next event

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event snd_seq_oss_read() checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it f…

7.5Hoch

CVE-2026-98911 vor 19 Tagen

dpaa2-switch: fix the error path in dpaa2_switch_rx()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect sinc…

Ohne Score

CVE-2026-98909 vor 19 Tagen

net: cpsw_new: unregister devlink on port registration failure

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: unregister devlink on port registration failure cpsw_probe() registers devlink before registering the CPSW ports. If cpsw_register_ports() fails, the error path only unregis…

Ohne Score

CVE-2026-98907 vor 19 Tagen

btrfs: protect sb_write_pointer() with invalidate lock

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sb_write_pointer() with invalidate lock sb_write_pointer() reads the super block from the block device page cache using read_cache_page_gfp(). This has the same race with BLK…