8.1High

CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos

OpenSSH; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Red Hat Enterprise Linux 9.2 Exten… Published: 2024-07-01 15:37 (2 years ago)

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Weakness (CWE): CWE-364 CWE-362

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
almalinux	almalinux	9.0
amazon	amazon linux	2023.0
apple	macos	12.0 – < 12.7.6
arista	eos	4.32.0 – ≤ 4.32.1f
canonical	ubuntu linux	23.10
debian	debian linux	12.0
enterprise linux	9	—
freebsd	freebsd	13.2
netapp	500f firmware	—
netapp	8300 firmware	—
netapp	8700 firmware	—
netapp	a150 firmware	—
netapp	a1k firmware	—
netapp	a220 firmware	—
netapp	a250 firmware	—
netapp	a400 firmware	—
netapp	a70 firmware	—
netapp	a700s firmware	—
netapp	a800 firmware	—
netapp	a90 firmware	—
netapp	a900 firmware	—
netapp	a9500 firmware	—
netapp	active iq unified manager	—
netapp	bootstrap os	—
netapp	c190 firmware	—
netapp	c250 firmware	—
netapp	c400 firmware	—
netapp	c800 firmware	—
netapp	e-series santricity os controller	11.0.0 – ≤ 11.70.2
netapp	fas2720 firmware	—
netapp	fas2750 firmware	—
netapp	fas2820 firmware	—
netapp	ontap	9
netapp	ontap select deploy administration utility	—
netapp	ontap tools	9
netbsd	netbsd	≤ 10.0.0
openbsd	openssh	< 4.4
openshift	4.13	—
openshift	4.14	—
openshift	4.15	—
openshift	4.16	—
redhat	enterprise linux	9.0
redhat	enterprise linux eus	9.4
redhat	enterprise linux for arm 64	9.0_aarch64
redhat	enterprise linux for arm 64 eus	9.4_aarch64
redhat	enterprise linux for ibm z systems	9.0_s390x
redhat	enterprise linux for ibm z systems eus	9.4_s390x
redhat	enterprise linux for power little endian	9.0_ppc64le
redhat	enterprise linux for power little endian eus	9.4_ppc64le
redhat	enterprise linux server aus	9.4
redhat	openshift container platform	4.0
Red Hat	Red Hat Ceph Storage 5	—
Red Hat	Red Hat Ceph Storage 6	—
Red Hat	Red Hat Ceph Storage 7	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	all versions
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions	all versions
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	all versions
Red Hat	Red Hat OpenShift Container Platform 4	all versions
Red Hat	Red Hat OpenShift Container Platform 4.13	all versions
Red Hat	Red Hat OpenShift Container Platform 4.14	all versions
Red Hat	Red Hat OpenShift Container Platform 4.15	all versions
Red Hat	Red Hat OpenShift Container Platform 4.16	all versions
rhel e4s	9.0	—
rhel eus	9.2	—
Siemens	Industrial Edge Management OS (IEM-OS)	0
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5
Siemens	SINAMICS IIoT module	< V1.0 HF1
Siemens	SINEMA Remote Connect Server	< V3.2 SP2
Siemens	SINUMERIK ONE	< V6.24
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5
sonicwall	sma 6200 firmware	—
sonicwall	sma 6210 firmware	—
sonicwall	sma 7200 firmware	—
sonicwall	sma 7210 firmware	—
sonicwall	sma 8200v firmware	—
sonicwall	sra ex 7000 firmware	—
suse	linux enterprise micro	6.0
—	OpenSSH	8.5p1 – ≤ 9.7p1

References and patches

RHSA-2024:4312 vendor-advisoryThird Party Advisory
RHSA-2024:4340 vendor-advisoryThird Party Advisory
RHSA-2024:4389 vendor-advisoryThird Party Advisory
RHSA-2024:4469 vendor-advisoryThird Party Advisory
RHSA-2024:4474 vendor-advisoryThird Party Advisory
RHSA-2024:4479 vendor-advisoryThird Party Advisory
RHSA-2024:4484 vendor-advisoryThird Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387 vdb-entryThird Party Advisory
RHBZ#2294604 issue-trackingThird Party Advisory
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html ExploitThird Party Advisory
https://www.openssh.com/txt/release-9.8 Release NotesThird Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt ExploitThird Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18 Mailing List
http://seclists.org/fulldisclosure/2024/Jul/19 Mailing List
http://seclists.org/fulldisclosure/2024/Jul/20 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/12 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/01/13 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/02/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/11 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/03/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/3 Mailing ListPatch
http://www.openwall.com/lists/oss-security/2024/07/03/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/03/5 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/04/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/04/2 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/08/2 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/08/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/09/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/09/5 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/10/1 ExploitMailing List
http://www.openwall.com/lists/oss-security/2024/07/10/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/10/6 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/11/1 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/11/3 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/23/4 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/23/6 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/28/2 Mailing List
http://www.openwall.com/lists/oss-security/2024/07/28/3 Mailing List
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ Third Party Advisory
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ Press/Media CoverageThird Party Advisory
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-ex… Press/Media CoverageThird Party Advisory
https://explore.alas.aws.amazon.com/CVE-2024-6387.html Third Party Advisory
https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 Issue Tracking
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc Release Notes
https://github.com/AlmaLinux/updates/issues/629 Issue Tracking
https://github.com/Azure/AKS/issues/4379 Issue Tracking
https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 Issue Tracking
https://github.com/PowerShell/Win32-OpenSSH/issues/2249 Issue Tracking
https://github.com/microsoft/azurelinux/issues/9555 Issue Tracking
https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 Patch
https://github.com/oracle/oracle-linux/issues/149 Issue Tracking
https://github.com/rapier1/hpn-ssh/issues/87 Issue Tracking
https://github.com/zgzhang/cve-2024-6387-poc Third Party Advisory
https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ Third Party Advisory
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html Mailing ListRelease Notes
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html Mailing ListPatch
https://news.ycombinator.com/item?id=40843778 Issue TrackingPatch

CPE matches (NVD) (60)

cpe:2.3:o:sonicwall:sma_6200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_7200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.32.0 ≤ 4.32.1f
cpe:2.3:o:canonical:ubuntu_linux:23.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:24.04:*:*:*:lts:*:*:*
cpe:2.3:o:almalinux:almalinux:9.0:-:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_6210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_7210_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sma_8200v_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sra_ex_7000_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a9500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 12.0 < 12.7.6
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 13.0 < 13.6.8
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 14.0 < 14.6
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* < 4.4
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* ≥ 8.6 ≤ 9.8
cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
cpe:2.3:a:openbsd:openssh:8.6:-:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*
cpe:2.3:o:amazon:amazon_linux:2023.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.70.2
cpe:2.3:a:netapp:ontap:9:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

CVSS score

8.1High

Source: redhat · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (3)

cna	CVSS 3.1	8.1High
secalert@redhat.com	CVSS 3.1	8.1High
nvd	CVSS 3.1	8.1High

EPSS (chance of exploitation in 30 days)

99.51%

higher than 100% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: total

Timeline

ID reserved2024-06-27
Published2024-07-01 15:37
Reached IP-DB2026-10-24 23:25
Last updated2026-11-07 00:17

Assigned by (CNA): redhat
NVD status: Modified

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Ubuntu 22.04 LTS

High

CVE-2026-106023 3 days ago

Apache HTTP Server: mod_md NULL pointer dereference leads to child process crash

Apache Software Foundation Apache HTTP Server

NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.69.

Low

CVE-2026-109163 3 days ago

Apache HTTP Server: mod_vhost_alias 1 byte stack buffer overwrite (after CVE-2026-63292)

Apache Software Foundation Apache HTTP Server

Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292) This issue affects Apache HTTP Server: 2.4.69.

8.1High

CVE-2026-119618 3 days ago

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Apache Software Foundation Apache HTTP Server

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from …

1.3%EPSS

7.7High

CVE-2026-109518 10 days ago

APT RCE via hard link reuse

Debian APT; Ubuntu APT

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into install…

7.0High

CVE-2026-84243 15 days ago

gettext: Directory traversal via the LANGUAGE environment variable

The GNU C Library glibc

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the en…

7.8High

CVE-2026-114148 16 days ago

ASP.NET Core Elevation of Privilege Vulnerability

Microsoft .NET 10.0 installed on Linux; Microsoft .NET 10.0 installed on Mac OS; Microsoft .NET 10.0 installed on Windows; Microsoft .NET 11.0 installed on Linux

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.