A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd     server.(CVE-2024-6409)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd     server.(CVE-2024-6409)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4910 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4716 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-651 advisory.

    A signal handler race condition vulnerability was found in OpenSSH's server (sshd), where a client does     not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's     SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are     not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race     condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the     unprivileged child of the SSHD server. (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-43.el9 build changelog.

  - A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
    (CVE-2024-6409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4457 advisory.

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Rocky Linux     9 (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4457 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4457 advisory.

    [8.7p1-38.0.2.4]
    - Possible remote code execution due to a race condition (CVE-2024-6409)       Resolves: RHEL-45741

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
209768	EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2024-2774)	Nessus	Huawei Local Security Checks	high
209761	EulerOS Virtualization 2.12.1 : openssh (EulerOS-SA-2024-2756)	Nessus	Huawei Local Security Checks	high
208407	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2536)	Nessus	Huawei Local Security Checks	high
208389	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2511)	Nessus	Huawei Local Security Checks	high
204862	RHEL 9 : openssh (RHSA-2024:4910)	Nessus	Red Hat Local Security Checks	high
203133	RHEL 9 : openssh (RHSA-2024:4716)	Nessus	Red Hat Local Security Checks	high
202916	Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-651)	Nessus	Amazon Linux Local Security Checks	high
202392	CentOS 9 : openssh-8.7p1-43.el9	Nessus	CentOS Local Security Checks	high
202382	Rocky Linux 9 : openssh (RLSA-2024:4457)	Nessus	Rocky Linux Local Security Checks	high
202158	RHEL 9 : openssh (RHSA-2024:4457)	Nessus	Red Hat Local Security Checks	high
202153	Oracle Linux 9 : openssh (ELSA-2024-4457)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2024-6409

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high