CVE-2024-6387

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

References

https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/

https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-15

https://www.securityweek.com/cisco-patches-high-severity-vulnerability-reported-by-nsa/

https://support.apple.com/en-us/HT214118

https://www.openwall.com/lists/oss-security/2024/07/10/2

https://securityaffairs.com/165535/hacking/openssh-flaw-cve-2024-6409.html?web_view=true

https://cloud.google.com/support/bulletins/index#gcp-2024-040

https://www.openssh.com/txt/release-9.8

https://www.openssh.com/releasenotes.html

https://santandersecurityresearch.github.io/blog/sshing_the_masses.html

https://bugzilla.redhat.com/show_bug.cgi?id=2294604

https://access.redhat.com/security/cve/CVE-2024-6387

https://access.redhat.com/errata/RHSA-2024:4484

https://access.redhat.com/errata/RHSA-2024:4479

https://access.redhat.com/errata/RHSA-2024:4474

https://access.redhat.com/errata/RHSA-2024:4469

https://access.redhat.com/errata/RHSA-2024:4389

https://access.redhat.com/errata/RHSA-2024:4340

https://access.redhat.com/errata/RHSA-2024:4312

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4