CVE-2024-6387

July 1, 2024, 7:15 p.m.

8.1
High

Description

A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().

Product(s) Impacted

Product Versions
OpenSSH
  • all versions

Weaknesses

CWE-364
Signal Handler Race Condition
The product uses a signal handler that introduces a race condition.

References

http://www.openwall.com/lists/oss-security/2024/07/01/12
https://access.redhat.com/security/cve/CVE-2024-6387
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
https://bugzilla.redhat.com/show_bug.cgi?id=2294604
https://explore.alas.aws.amazon.com/CVE-2024-6387.html
https://github.com/oracle/oracle-linux/issues/149
https://github.com/rapier1/hpn-ssh/issues/87
https://github.com/zgzhang/cve-2024-6387-poc
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
https://news.ycombinator.com/item?id=40843778
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
https://security-tracker.debian.org/tracker/CVE-2024-6387
https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
https://ubuntu.com/security/CVE-2024-6387
https://ubuntu.com/security/notices/USN-6859-1
https://www.openssh.com/txt/release-9.8
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
https://www.suse.com/security/cve/CVE-2024-6387.html
https://www.theregister.com/2024/07/01/regresshion_openssh/

Tags

secalert@redhat.com
2024-07-01
CVE-2024-6387
CWE-364

CVSS Score

8.1 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: July 1, 2024, 1:15 p.m.
  • Last Modified: July 1, 2024, 7:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.