OpenSSH on RHEL: signal handler race condition in OpenSSH (CVE-2024-6387) #shorts #breaking

CVE

This CVE relates to a newly identified vulnerability known as CVE-2024-6387 in OpenSSH, which is specifically a signal handler race condition. This issue is found in OpenSSH's server-side application, sshd. If a client doesn't authenticate within a time window called LoginGraceTime, a default of 120 seconds in modern versions of OpenSSH, an asynchronous signal handler is triggered. Unfortunately, this handler executes functions that are not safe to be called in such asynchronous contexts, like syslog(). This flaw makes it possible for attackers to exploit this timing vulnerability to execute remote code. Users of OpenSSH on Linux systems that are based on glibc, particularly those using Red Hat Enterprise Linux versions 6, 7, 8, and 9, could be impacted.

Watch the full video on YouTube: CVE-2024-6387

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2024-6387

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Provider

redhat

CWE / problem types

Signal Handler Race Condition

Affected Software Versions

None:None:[{'status': 'affected', 'version': '8.5p1', 'versionType': 'custom', 'lessThanOrEqual': '9.7p1'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:8.7p1-38.el9_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:8.7p1-38.el9_4.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:[{'version': '0:8.7p1-12.el9_0.1', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.2 Extended Update Support:[{'version': '0:8.7p1-30.el9_2.4', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.13:[{'version': '413.92.202407091321-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.14:[{'version': '414.92.202407091253-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.15:[{'version': '415.92.202407091355-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.16:[{'version': '416.94.202407081958-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Ceph Storage 5:None,Red Hat:Red Hat Ceph Storage 6:None,Red Hat:Red Hat Ceph Storage 7:None,Red Hat:Red Hat Enterprise Linux 6:None,Red Hat:Red Hat Enterprise Linux 7:None,Red Hat:Red Hat Enterprise Linux 8:None

Date Published

2024-07-01T12:37:25.431Z

Last Updated

2025-04-24T18:35:27.934Z