RHEL 9: Signal Handler Race Condition (CVE-2024-6409) #shorts #breaking

CVE

This CVE relates to a vulnerability in the OpenSSH server, specifically within how signals are managed. Identified as a Signal Handler Race Condition, this flaw can be exploited when a remote user fails to authenticate within a designated time, leading to the asynchronous call of the SIGALRM handler. This handler executes functions that are unsafe for such use, like syslog. In the worst-case scenario, a successful exploit could allow an attacker to execute code remotely as an unprivileged user on the Red Hat Enterprise Linux 9 system, potentially compromising security. While no specific attacks have been reported thus far, it remains a critical concern for users operating OpenSSH servers on this Linux distribution.

Watch the full video on YouTube: CVE-2024-6409

Remediation and exploitation details

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

CVE database technical details

CVE ID

CVE-2024-6409

Description

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Provider

redhat

CWE / problem types

Signal Handler Race Condition

Affected Software Versions

None:None:None,Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:8.7p1-38.el9_4.4', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9:[{'version': '0:8.7p1-38.el9_4.4', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions:[{'version': '0:8.7p1-12.el9_0.3', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 9.2 Extended Update Support:[{'version': '0:8.7p1-30.el9_2.7', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.13:[{'version': '413.92.202408122222-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.14:[{'version': '414.92.202407300859-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.15:[{'version': '415.92.202407301159-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat OpenShift Container Platform 4.16:[{'version': '416.94.202407171205-0', 'lessThan': '*', 'versionType': 'rpm', 'status': 'unaffected'}],Red Hat:Red Hat Enterprise Linux 6:None,Red Hat:Red Hat Enterprise Linux 7:None,Red Hat:Red Hat Enterprise Linux 8:None

Date Published

2024-07-08T17:57:10.517Z

Last Updated

2024-11-24T17:26:14.437Z