CVE-2024-6387
published 2024-07-01CVE-2024-6387: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an…
PriorityP190high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
99.51%
99.9th percentile
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Affected
60 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| almalinux | almalinux | — | — |
| amazon | amazon_linux | — | — |
| apple | macos | >= 12.0 < 12.7.6 | 12.7.6 |
| apple | macos | >= 13.0 < 13.6.8 | 13.6.8 |
| apple | macos | >= 14.0 < 14.6 | 14.6 |
| apple | macos_monterey | — | — |
| apple | macos_sonoma | — | — |
| apple | macos_ventura | — | — |
| arista | eos | 4.32.0 – 4.32.1f | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | openssh | < openssh 1:9.2p1-2+deb12u3 (bookworm) | openssh 1:9.2p1-2+deb12u3 (bookworm) |
| debian | openssh | — | — |
| freebsd | freebsd | < 13.0 | 13.0 |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | — | — |
| freebsd | freebsd | >= 13.1 < 13.3 | 13.3 |
| freebsd | freebsd | >= 13.3-RELEASE < p5 | p5 |
| freebsd | freebsd | >= 14.0-RELEASE < p9 | p9 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor auth.log (or equivalent) for login attempts with usernames containing shell metacharacters such as backticks (`), dollar signs ($), or parentheses — these are indicators of CVE-2024-6387 exploitation attempts. ↗
- →Alert on suspicious child processes spawned by sshd, particularly unexpected outbound network connections originating from the sshd process tree. ↗
- →Detect exploitation attempts by monitoring for a high volume of SSH connection attempts (~10,000) from a single or rotating set of source IPs — exploitation requires thousands of attempts to trigger the SIGALRM race condition. ↗
- →Use XQL to hunt for vulnerable OpenSSH endpoints: filter on product_major_version = 8 or 9 (minor < 8) to identify exposed instances in Cortex XDR/XSIAM telemetry. ↗
- →Be alert to fake PoC archives circulating on social media (e.g., X/Twitter) purporting to exploit CVE-2024-6387 — these contain malware that modifies system files and retrieves payloads from remote servers, targeting researchers with disabled security controls. ↗
- →Exploitation is only proven on 32-bit glibc-based Linux systems with ASLR; prioritize detection and patching on those platforms first, but do not discount 64-bit systems. ↗
- ·Vulnerable OpenSSH version ranges: < 4.4p1 (unless backport-patched for CVE-2006-5051 / CVE-2008-4109) and >= 8.5p1 to < 9.8p1. Versions 4.4p1 up to (not including) 8.5p1 are not affected. ↗
- ·The race condition is triggered when a client fails to authenticate within LoginGraceTime (default 120 seconds), causing SIGALRM to invoke async-signal-unsafe functions (syslog → malloc/free) in the privileged, unsandboxed sshd context. ↗
- ·Setting LoginGraceTime to 0 in sshd_config mitigates the vulnerability but may introduce denial-of-service risks; it is a temporary workaround, not a fix. ↗
- ·Backporting by Linux distributions means instances may display a vulnerable version string while actually running a patched build — version-based detection will overcount vulnerable hosts. ↗
- ·Exploitation on 64-bit systems is theoretically possible but has not been demonstrated; ASLR entropy on x64 makes reliable exploitation highly impractical. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
osv8.1HIGH
vulncheck8.1HIGH
vendor_cisco8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_oracle8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SIMATIC S7-1500 CPU Family
cisa_ics·2025-06-12
Siemens SIMATIC S7-1500 CPU Family
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU Family
Release DateJune 12, 2025
Alert CodeICSA-25-162-05
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU family
- Vulnerabilities: Missing Encryption of Sensitive Data, Out-of-bounds Read, Use After Free, Stack-
CISA ICS
ABB Arctic Wireless Gateways
cisa_ics·2025-04-10·CVSS 8.1
[HIGH] ABB Arctic Wireless Gateways
ICS Advisory
##
ABB Arctic Wireless Gateways
Release DateApril 10, 2025
Alert CodeICSA-25-100-09
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 9.2
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: ABB
- Equipment: Arctic Wireless Gateways
- Vulnerabilities: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Improper Privilege Management, Exposure of Sensitive Information to an Unauthorized Actor, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities
Oracle
Oracle Oracle Communications Risk Matrix: Patch (OpenSSH) — CVE-2024-6387
vendor_oracle·2024-10-15·CVSS 8.1
CVE-2024-6387 [HIGH] Oracle Oracle Communications Risk Matrix: Patch (OpenSSH) — CVE-2024-6387
Oracle Oracle Communications Risk Matrix: Patch (OpenSSH) vulnerability
CVE: CVE-2024-6387
CVSS: 8.1
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
CISA ICS
Siemens Industrial Products
cisa_ics·2024-09-12·CVSS 8.1
[HIGH] Siemens Industrial Products
ICS Advisory
##
Siemens Industrial Products
Release DateSeptember 12, 2024
Alert CodeICSA-24-256-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 8.1
- ATTENTION: Exploitable remotely
- Vendor: Siemens
- Equipment: Industrial Edge Management OS (IEM-OS), SINEMA Remote Connect Server, SINUMERIK ONE
- Vulnerability: Signal Handler Race Condition
## 2. RISK EVALUAT
Red Hat
openssh: OpenSSH pre-authentication async signal safety issue
vendor_redhat·2024-08-12·CVSS 8.1
CVE-2024-7589 [HIGH] CWE-362 openssh: OpenSSH pre-authentication async signal safety issue
openssh: OpenSSH pre-authentication async signal safety issue
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges.
This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.
As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated re
BSD
FreeBSD-SA-24:08.openssh: OpenSSH pre-authentication async signal safety issue
bsd_advisories·2024-08-07·CVSS 8.1
CVE-2006-5051 [HIGH] FreeBSD-SA-24:08.openssh: OpenSSH pre-authentication async signal safety issue
FreeBSD-SA-24:08.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH pre-authentication async signal safety issue
Category: contrib
Module: openssh
Announced: 2024-08-07
Affects: All supported versions of FreeBSD.
Corrected: 2024-08-06 19:43:54 UTC (stable/14, 14.1-STABLE)
2024-08-07 13:44:26 UTC (releng/14.1, 14.1-RELEASE-p3)
2024-08-07 13:44:40 UTC (releng/14.0, 14.0-RELEASE-p9)
2024-08-06 19:46:19 UTC (stable/13, 13.3-STABLE)
2024-08-07 13:44:58 UTC (releng/13.3, 13.3-RELEASE-p5)
CVE Name: CVE-2024-7589
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit .
I. Background
OpenSSH is an implementation of the SSH protocol suite, providing an
encrypted and authenti
Apple
CVE-2024-6387: macOS Ventura 13.6.8
vendor_apple·2024-07-29·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387: macOS Ventura 13.6.8
Apple Security Update: About the security content of macOS Ventura 13.6.8
Product: macOS Ventura
Version: 13.6.8
CVE: CVE-2024-6387
Component: CVE-2024-6387
Apple
CVE-2024-6387: macOS Sonoma 14.6
vendor_apple·2024-07-29·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387: macOS Sonoma 14.6
Apple Security Update: About the security content of macOS Sonoma 14.6
Product: macOS Sonoma
Version: 14.6
CVE: CVE-2024-6387
Component: CVE-2024-6387
Apple
CVE-2024-6387: macOS Monterey 12.7.6
vendor_apple·2024-07-29·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387: macOS Monterey 12.7.6
Apple Security Update: About the security content of macOS Monterey 12.7.6
Product: macOS Monterey
Version: 12.7.6
CVE: CVE-2024-6387
Component: CVE-2024-6387
Microsoft
RedHat Openssh: CVE-2024-6387 Remote Code Execution Due To A Race Condition In Signal Handling
vendor_msrc·2024-07-09·CVSS 8.1
CVE-2024-6387 [HIGH] CWE-364 RedHat Openssh: CVE-2024-6387 Remote Code Execution Due To A Race Condition In Signal Handling
RedHat Openssh: CVE-2024-6387 Remote Code Execution Due To A Race Condition In Signal Handling
FAQ: Why is the Red Hat Inc. the assigning CNA (CVE Numbering Authority)?
CVE-2024-6387 is regarding a vulnerability in OppenSSH's server (sshd). Red Hat created this CVE on its behalf.
FAQ: Is Microsoft Windows vulnerable to CVE-2024-6387?
No, Microsoft Windows is not affected by this vulnerability. Although Windows contains an OpenSSH component, the vulnerable code cannot be exploited or controlled by an adversary.
The race condition used in this exploit is not possible in Windows because of significant differences with login grace timeout handling in the win32-openssh implementation.
FAQ: Is the update for Azure Kubernetes Service Nodes on Ubuntu Linux currently available?
The security upda
Red Hat
openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
vendor_redhat·2024-07-08·CVSS 8.1
CVE-2024-6409 [HIGH] CWE-364 openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time p
Cisco
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
vendor_cisco·2024-07-02·CVSS 8.1
CVE-2024-6387 [HIGH] CWE-364 Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
On July 1, 2024, the Qualys Threat Research Unit (TRU) disclosed an unauthenticated, remote code execution vulnerability that affects the OpenSSH server (sshd) in glibc-based Linux systems.
CVE-2024-6387: A signal handler race condition was found in sshd, where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then the sshd SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().
For a description of this vulnerability, see the Qualys Security Advisory.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/cen
BSD
FreeBSD-SA-24:04.openssh: OpenSSH pre-authentication remote code execution
bsd_advisories·2024-07-01·CVSS 8.1
CVE-2006-5051 [HIGH] FreeBSD-SA-24:04.openssh: OpenSSH pre-authentication remote code execution
FreeBSD-SA-24:04.openssh Security Advisory
The FreeBSD Project
Topic: OpenSSH pre-authentication remote code execution
Category: contrib
Module: openssh
Announced: 2024-07-01
Credits: Qualys Threat Research Unit (TRU)
Affects: All supported versions of FreeBSD.
Corrected: 2024-07-01 08:22:13 UTC (stable/14, 14.1-STABLE)
2024-07-01 08:24:48 UTC (releng/14.1, 14.1-RELEASE-p2)
2024-07-01 08:26:05 UTC (releng/14.0, 14.0-RELEASE-p8)
2024-07-01 08:23:16 UTC (stable/13, 13.3-STABLE)
2024-07-01 08:27:10 UTC (releng/13.3, 13.3-RELEASE-p4)
2024-07-01 08:27:53 UTC (releng/13.2, 13.2-RELEASE-p12)
CVE Name: CVE-2024-6387
Note: Due to the fact this advisory is being released the day after
13.2-RELEASE is going out of support, the Security Team has decided to
include 13.2-RELEASE in the response for t
Red Hat
openssh: regreSSHion - race condition in SSH allows RCE/DoS
vendor_redhat·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] CWE-364 openssh: regreSSHion - race condition in SSH allows RCE/DoS
openssh: regreSSHion - race condition in SSH allows RCE/DoS
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Statement: Red Hat rates the severity of this flaw as Important for both Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform (OCP). The most significant
Ubuntu
OpenSSH vulnerability
vendor_ubuntu·2024-07-01
CVE-2024-6387 OpenSSH vulnerability
Title: OpenSSH vulnerability
Summary: OpenSSH could be made to bypass authentication and remotely
access systems without proper credentials.
It was discovered that OpenSSH incorrectly handled signal management. A
remote attacker could use this issue to bypass authentication and remotely
access systems without proper credentials.
Instructions: In general, a standard system update will make all the necessary changes.
Palo Alto
Informational Bulletin: Impact of OpenSSH regreSSHion Vulnerability
vendor_paloalto·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] CWE-364 Informational Bulletin: Impact of OpenSSH regreSSHion Vulnerability
Informational Bulletin: Impact of OpenSSH regreSSHion Vulnerability
The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-6387, known as "regreSSHion", as it relates to our products.
The SSH features in PAN-OS are not affected by CVE-2024-6387.
At present, no other Palo Alto Networks products are known to contain the vulnerable software packages and be impacted by these issues.
Protecting our customers is our highest priority. Palo Alto Networks and its Unit 42 threat research team are closely monitoring all developments. More information can be found in the Unit 42 threat brief: https://unit42.paloaltonetworks.com/threat-brief-cve-2024-6387-openssh/
Affected products: Cloud NGFW, PAN-OS, Prisma Access
Solution: No software updates are required at this time.
Debian
CVE-2024-7589: openssh - A signal handler in sshd(8) may call a logging function that is not async-signal...
vendor_debian·2024·CVSS 8.1
CVE-2024-7589 [HIGH] CVE-2024-7589: openssh - A signal handler in sshd(8) may call a logging function that is not async-signal...
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
Scope: local
bookworm: resolved
bu
Debian
CVE-2024-6387: openssh - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)....
vendor_debian·2024·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387: openssh - A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)....
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Scope: local
bookworm: resolved (fixed in 1:9.2p1-2+deb12u3)
bullseye: resolved
forky: resolved (fixed in 1:9.7p1-7)
sid: resolved (fixed in 1:9.7p1-7)
trixie: resolved (fixed in 1:9.7p1-7)
Cisco
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
vendor_cisco·CVSS 3.1
CVE-2024-6387 Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
CVE-2024-6387: Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
On July 1, 2024, the Qualys Threat Research Unit (TRU) disclosed an unauthenticated, remote code execution vulnerability that affects the OpenSSH server (sshd) in glibc-based Linux systems. CVE-2024-6387: A signal handler race condition was found in sshd, where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then the sshd SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). For a description of this vulnerability, see the Qualys Security Advisory . This advisory is available at the following link: https://sec.cloudapps.cisco.co
Cisco
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
vendor_cisco·CVSS 3.1
CVE-2006-5051 Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
CVE-2006-5051: Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024
On July 1, 2024, the Qualys Threat Research Unit (TRU) disclosed an unauthenticated, remote code execution vulnerability that affects the OpenSSH server (sshd) in glibc-based Linux systems. CVE-2024-6387: A signal handler race condition was found in sshd, where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then the sshd SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). For a description of this vulnerability, see the Qualys Security Advisory . This advisory is available at the following link: https://sec.cloudapps.cisco.co
GHSA
GHSA-j7jm-6q5x-ffr4: A signal handler in sshd(8) may call a logging function that is not async-signal-safe
ghsa_unreviewed·2024-08-12·CVSS 8.1
CVE-2024-7589 [HIGH] CWE-362 GHSA-j7jm-6q5x-ffr4: A signal handler in sshd(8) may call a logging function that is not async-signal-safe
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges.
This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.
As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
GHSA
GHSA-79hg-h6r6-64mm: A signal handler race condition vulnerability was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds
ghsa_unreviewed·2024-07-08·CVSS 8.1
CVE-2024-6409 [HIGH] CWE-364 GHSA-79hg-h6r6-64mm: A signal handler race condition vulnerability was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds
A signal handler race condition vulnerability was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server.
GHSA
GHSA-2x8c-95vh-gfv4: A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by defau
ghsa_unreviewed·2024-07-01
CVE-2024-6387 [HIGH] CWE-362 GHSA-2x8c-95vh-gfv4: A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by defau
A signal handler race condition was found in OpenSSH's server (sshd), where a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog().
OSV
CVE-2024-6387: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
osv·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
VulnCheck
SonicWall sma_6200_firmware Signal Handler Race Condition
vulncheck·2024·CVSS 8.1
CVE-2024-6387 [HIGH] SonicWall sma_6200_firmware Signal Handler Race Condition
SonicWall sma_6200_firmware Signal Handler Race Condition
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Affected: SonicWall sma_6200_firmware
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.cadosecurity.com/blog/warpscan-cloudflare-warp-abused-to-hijack-cloud-services-blog; https://content.kaspersky-labs.com/fm/site-editor/33/3318ec849851138088d24f26d236f469/source/irreport.pdf; https://app.crowdsec.net/cti/
No detection rules found.
Qualys
Mutagen Astronomy: From Discovery to CISA Recognition—A Seven-Year Journey
blogs_qualys·2026-02-02·CVSS 7.8
CVE-2018-14634 [HIGH] Mutagen Astronomy: From Discovery to CISA Recognition—A Seven-Year Journey
## Table of Contents
Introduction
Why This Matters Now
Looking Back: The Original Discovery
Guidance for Security Teams
A Note on Our Research Mission
Conclusion
Frequently Asked Questions (FAQs)
## Introduction
On January 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2018-14634 to its Known Exploited Vulnerabilities (KEV) catalog . The same vulnerability was discovered by the Qualys Threat Research Unit (TRU) in September 2018.
We nicknamed it “Mutagen Astronomy” as a tribute to the 1992 film Sneakers . In that movie, the phrase “Setec Astronomy” is revealed as an anagram for “Too Many Secrets.” Following that tradition, “Mutagen Astronomy” is our anagram for “Too Many Arguments”, which precisely captures the technical root cause of this vulnera
Qualys
Mutagen Astronomy: A Linux Vulnerability’s Path to CISA KEV | Qualys
blogs_qualys·2026-02-02·CVSS 7.8
CVE-2018-14634 [HIGH] Mutagen Astronomy: A Linux Vulnerability’s Path to CISA KEV | Qualys
#### Table of Contents
- Introduction
- Why This Matters Now
- Looking Back: The Original Discovery
- Guidance for Security Teams
- A Note on Our Research Mission
- Conclusion
- Frequently Asked Questions (FAQs)
## Introduction
On January 26, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2018-14634 to its Known Exploited Vulnerabilities (KEV) catalog. The same vulnerability was discovered by the Qualys Threat Research Unit (TRU) in September 2018.
We nicknamed it “Mutagen Astronomy” as a tribute to the 1992 film Sneakers. In that movie, the phrase “Setec Astronomy” is revealed as an anagram for “Too Many Secrets.” Following that tradition, “Mutagen Astronomy” is our anagram for “Too Many Arguments”, which precisely captures the technical root cause of this
Qualys
Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025
blogs_qualys·2025-08-12·CVSS 8.1
CVE-2024-6387 [HIGH] Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025
## Table of Contents
Why these two matter
Key Takeaways for Security Leaders: What Patching Really Looks Like
How Qualys Customers Achieve Same-Day Closes with TruRisk
We’re honored that the Pwnie Awards recognized the Qualys Threat Research Unit (TRU) with two wins at Black Hat/DEF CON this year—Best RCE for regreSSHion (CVE-2024-6387) and Epic Achievement for our multi-year work uncovering issues in OpenSSH, including CVE-2025-26465. Awards are nice; what matters is what the research means for defenders.
The Pwnie Awards, held annually at Black Hat and DEF CON, celebrate groundbreaking (and sometimes infamous) achievements in cybersecurity. Winning two in one year—especially for high-impact vulnerabilities in a staple like OpenSSH—is a massive validation for our TRU team. It undersc
Qualys
Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025 | Qualys
blogs_qualys·2025-08-12·CVSS 8.1
CVE-2024-6387 [HIGH] Two Pwnie Awards, One Crucial Lesson: What Our OpenSSH Research Reveals About Cyber Defense in 2025 | Qualys
#### Table of Contents
- Why these two matter
- Key Takeaways for Security Leaders: What Patching Really Looks Like
- How Qualys Customers Achieve Same-Day Closes with TruRisk
We’re honored that the Pwnie Awards recognized the Qualys Threat Research Unit (TRU) with two wins at Black Hat/DEF CON this year—Best RCE for regreSSHion (CVE-2024-6387) and Epic Achievement for our multi-year work uncovering issues in OpenSSH, including CVE-2025-26465. Awards are nice; what matters is what the research means for defenders.
The Pwnie Awards, held annually at Black Hat and DEF CON, celebrate groundbreaking (and sometimes infamous) achievements in cybersecurity. Winning two in one year—especially for high-impact vulnerabilities in a staple like OpenSSH—is a massive validation for our TRU team. It u
Zscaler
CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
blogs_zscaler·2025-03-27·CVSS 9.1
[CRITICAL] CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Securelist
Exploits and vulnerabilities in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Exploits and vulnerabilities in Q3 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most prevalent exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-47177 (CUPS filters)
CVE-2024-38112 (MSHTML Spoofing)
CVE-2024-6387 (regreSSHion)
CVE-2024-3183 (Free IPA)
CVE-2024-45519 (Zimbra)
CVE-2024-5290 (Ubuntu wpa_supplicant)
Conclusion and advice
Authors
Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Co
Securelist
Analyzing the vulnerability landscape in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Analyzing the vulnerability landscape in Q3 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- CVE-2024-47177 (CUPS filters)
- CVE-2024-38112 (MSHTML Spoofing)
- CVE-2024-6387 (regreSSHion)
- CVE-2024-3183 (Free IPA)
- CVE-2024-45519 (Zimbra)
- CVE-2024-5290 (Ubuntu wpa_supplicant)
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number
Zscaler
CVE-2024-6387 & CVE-2024-6409 | ThreatLabz
blogs_zscaler·2024-08-05·CVSS 8.1
[HIGH] CVE-2024-6387 & CVE-2024-6409 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Trendmicro
The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
blogs_trendmicro·2024-07-17·CVSS 8.1
CVE-2024-6387 [HIGH] The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
Exploits & Vulnerabilities
# The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
We check the OpenSSH vulnerabilities CVE-2024–6387 and CVE-2024-6409, examining their potential real-world impact and the possibility of exploitation for CVE-2024–6387 in x64 systems.
By: Jagir Shastri
2024/07/17
Read time: ( words)
Save to Folio
# Introduction
CVE-2024–6387, also known as “regreSSHion,” is a vulnerability that exists in OpenSSH, a widely-used suite of secure networking utilities based on the SSH protocol. This vulnerability, which was discovered in July 2024, allows for remote unauthenticated code execution, potentially providing attackers root privileges on affected systems. The Common Vulnerability Scoring System (CVSS) has rated this vulnerability wit
Trendmicro
The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
blogs_trendmicro·2024-07-17·CVSS 7.0
CVE-2024-6409 [HIGH] The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
Exploits & Vulnerabilities
## The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
We check the OpenSSH vulnerabilities CVE-2024–6387 and CVE-2024-6409, examining their potential real-world impact and the possibility of exploitation for CVE-2024–6387 in x64 systems.
By: Jagir Shastri Jul 17, 2024 Read time: ( words)
Save to Folio
The “regreSSHion” vulnerability arises from the unsafe handling of the SIGALRM signal during SSH authentication. When the LoginGraceTime expires, the SIGALRM signal is raised, and the corresponding handler performs certain actions, including calling non-async-signal-safe functions like syslog(). This can create a race condition, where the timing of operations could lead to memory corruption or other unexpected behaviors.
Trendmicro
The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
blogs_trendmicro·2024-07-17·CVSS 7.0
CVE-2024-6409 [HIGH] The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
Exploits & Vulnerabilities
## The Potential Impact of the OpenSSH Vulnerabilities CVE-2024–6387 and CVE-2024-6409
We check the OpenSSH vulnerabilities CVE-2024–6387 and CVE-2024-6409, examining their potential real-world impact and the possibility of exploitation for CVE-2024–6387 in x64 systems.
By: Jagir Shastri 2024/07/17 Read time: ( words)
Save to Folio
The “regreSSHion” vulnerability arises from the unsafe handling of the SIGALRM signal during SSH authentication. When the LoginGraceTime expires, the SIGALRM signal is raised, and the corresponding handler performs certain actions, including calling non-async-signal-safe functions like syslog(). This can create a race condition, where the timing of operations could lead to memory corruption or other unexpected behaviors.
Checkpoint
8th July – Threat Intelligence Report
blogs_checkpoint·2024-07-08
CVE-2024-6387 8th July – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 8th July – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 8th July, please download our Threat Intelligence Bulletin .
TOP ATTACKS AND BREACHES
FIA, the governing body for Formula 1, disclosed a data breach stemming from a phishing attack on their email accounts. The attack led to unauthorized access to personal data, and the incident has been reported to relevant data protection regulators. FIA is taking steps to bolster security and has initiated protective measures fo
Tenable
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
blogs_tenable·2024-07-05
How the regreSSHion Vulnerability Could Impact Your Cloud Environment
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Unit42
Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
blogs_unit42·2024-07-02·CVSS 8.1
CVE-2024-6387 [HIGH] Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
## Executive Summary
On July 1, 2024, a critical signal handler race condition vulnerability was disclosed in OpenSSH servers (sshd) on glibc-based Linux systems. This vulnerability, called RegreSSHion and tracked as CVE-2024-6387, can result in unauthenticated remote code execution (RCE) with root privileges. This vulnerability has been rated High severity (CVSS 8.1).
This vulnerability impacts the following OpenSSH server versions:
- Open SSH version between 8.5p1-9.8p1
- Open SSH versions earlier than 4.4p1, if they’ve not backport-patched against CVE-2006-5051 or patched against CVE-2008-4109
The SSH features in PAN-OS are not affected by CVE-2024-6387.
Using Palo Alto Networks Xpanse data, we observed 23 million instances of OpenSSH servers including all versions. We saw over 7 m
Unit42
Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
blogs_unit42·2024-07-02·CVSS 8.1
CVE-2024-6387 [HIGH] Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
Threat Research Center
High Profile Threats
Vulnerabilities
## Threat Brief: CVE-2024-6387 OpenSSH RegreSSHion Vulnerability
Unit 42
Published: July 2, 2024
Cloud Cybersecurity Research
High Profile Threats
Vulnerabilities
CVE-2024-6387
OpenSSH
RegreSSHion
Remote Code Execution
SSH
## Executive Summary
On July 1, 2024, a critical signal handler race condition vulnerability was disclosed in OpenSSH servers ( sshd ) on glibc-based Linux systems. This vulnerability, called RegreSSHion and tracked as CVE-2024-6387 , can result in unauthenticated remote code execution (RCE) with root privileges. This vulnerability has been rated High severity ( CVSS 8.1 ).
This vulnerability impacts the following OpenSSH server versions:
Open SSH version between 8.5p1-9.8p1
Open SSH versio
Wiz
RCE vulnerability in OpenSSH: everything you need to know | Wiz Blog
blogs_wiz·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] RCE vulnerability in OpenSSH: everything you need to know | Wiz Blog
An unauthenticated RCE-as-root vulnerability was identified in OpenSSH server (sshd) by researchers from Qualys, assigned CVE-2024-6387 and dubbed regreSSHion. The vulnerability is a signal handler race condition and is known to be exploitable in the default configuration of OpenSSH in specific version ranges running on 32-bit glibc-based Linux distributions.
## What is CVE-2024-6387?
LoginGraceTime
syslog()
syslog()
malloc()
free()
The researchers who discovered this vulnerability analyzed the root cause and determined it to be a regression of an earlier vulnerability (CVE-2006-5051), meaning that the original vulnerability was accidentally reintroduced due to other code changes.
## How likely is this vulnerability to be exploited en masse?
Based on what is currently known about
Qualys
OpenSSH CVE-2024-6387 RCE Vulnerability: Risk & Mitigation | Qualys
blogs_qualys·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] OpenSSH CVE-2024-6387 RCE Vulnerability: Risk & Mitigation | Qualys
#### Table of Contents
- About OpenSSH: Securing SSH Communications and Protecting Infrastructure from OpenSSH Vulnerabilities
- OpenSSH Server Versions Affected by the regreSSHion Vulnerability
- Understanding the Potential Impact of regreSSHion Vulnerability on OpenSSH Exploits
- Immediate Steps to Mitigate the SSH Vulnerability
- Technical Details of the OpenSSH Exploit (CVE-2024-6387)
- Qualys QID Coverage for Detecting the OpenSSH Exploit
- Discover Vulnerable OpenSSH Assets with Qualys CyberSecurity Asset Management (CSAM)
- Enhancing Your Security Posture with Qualys VMDR to Detect and Remediate OpenSSH Vulnerabilities
- Unified Dashboard for regreSSHion: Track Exposure and Remediation of OpenSSH Exploits
- Automatically Patch regreSSHion Vulnerabilities with Qualys Patch Managemen
Wiz
RCE vulnerability in OpenSSH: everything you need to know | Wiz Blog
blogs_wiz·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] RCE vulnerability in OpenSSH: everything you need to know | Wiz Blog
An unauthenticated RCE-as-root vulnerability was identified in OpenSSH server (sshd) by researchers from Qualys, assigned CVE-2024-6387 and dubbed regreSSHion. The vulnerability is a signal handler race condition and is known to be exploitable in the default configuration of OpenSSH in specific version ranges running on 32-bit glibc-based Linux distributions.
# What is CVE-2024-6387?
A signal handler race condition vulnerability was discovered in OpenSSH server (sshd) affecting its default configuration. If an SSH client fails to authenticate within the `LoginGraceTime` period (120 seconds by default), then the SIGALRM (signal alarm) handler is called asynchronously, but some of the functions that it calls are not async-signal-safe, including `syslog()`. In glibc-based Linux distros, und
Qualys
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion)
blogs_qualys·2024-07-01·CVSS 8.1
CVE-2024-6387 [HIGH] Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion)
## Table of Contents
About OpenSSH: Securing SSH Communications and Protecting Infrastructure from OpenSSH Vulnerabilities
OpenSSH Server Versions Affected by the regreSSHion Vulnerability
Understanding the Potential Impact of regreSSHion Vulnerability on OpenSSH Exploits
Immediate Steps to Mitigate the SSH Vulnerability
Technical Details of the OpenSSH Exploit (CVE-2024-6387)
Qualys QID Coverage for Detecting the OpenSSH Exploit
Discover Vulnerable OpenSSH Assets with Qualys CyberSecurity Asset Management (CSAM)
Enhancing Your Security Posture with Qualys VMDR to Detect and Remediate OpenSSH Vulnerabilities
Unified Dashboard for regreSSHion: Track Exposure and Remediation of OpenSSH Exploits
Automatically Patch regreSSHion Vulnerabilities with Qualys Patch Management
Detect and
Huntress
CVE-2024-6387 Vulnerability: Analysis, Impact, Mitigation | Huntress
blogs_huntress·CVSS 6.5
CVE-2024-6387 [MEDIUM] CVE-2024-6387 Vulnerability: Analysis, Impact, Mitigation | Huntress
## CVE-2024-6387 Vulnerability
Published: 11/07/2025
Written by: Monica Burgess
CVE-2024-6387, also known as "Regresshion," is a critical remote code execution (RCE) vulnerability affecting specific versions of OpenSSH, the widely used tool for secure remote login. This flaw allows an unauthenticated attacker to execute arbitrary commands on a vulnerable server, potentially leading to a complete system compromise. Time to check those SSH versions.
## What is CVE-2024-6387 Vulnerability?
The CVE-2024-6387 vulnerability is a critical remote code execution flaw discovered in OpenSSH server (sshd). The issue stems from a regression introduced in OpenSSH version 9.7, which mishandles shell metacharacters in usernames during the login process. An unauthenticated attacker can exploit this by
Greynoiseio
Storm⚡Watch: Unplugged
blogs_greynoiseio
Storm⚡Watch: Unplugged
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
arXiv
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
arxiv_fulltext·2025-02-16
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
VulRG: Multi-Level Explainable Vulnerability Patch Ranking for Complex Systems Using Graphs
Yuning Jiang
[email protected]
0000-0003-4791-8452
National University of Singapore
Singapore
Nay Oo
[email protected]
NCS Cyber Special Ops R&D
Singapore
Qiaoran Meng
[email protected]
National University of Singapore
Singapore
Hoon Wei Lim
[email protected]
NCS Cyber Special Ops R&D
Singapore
Biplab Sikdar
[email protected]
National University of Singapore
Singapore
Jiang et al.
## Abstract
As interconnected systems proliferate, safeguarding complex infrastructures against an escalating array of cyber threats has become an urgent challenge. The growing number of vulnerabilities, coupled with resource constraints, makes addressing every vulnerability impractical, thereby rende
Bugzilla
CVE-2024-6409 openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
bugzilla·2024-07-01·CVSS 8.1
CVE-2024-6409 [HIGH] CVE-2024-6409 openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
CVE-2024-6409 openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
The OpenSSH version as shipped with Red Hat Enterprise Linux 9 is vulnerable to a signal handler race condition on cleanup_exit() function which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server. This vulnerability only affects the versions of OpenSSH shipped with Red Hat Enterprise Linux 9.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2024:4457 https://access.redhat.com/errata/RHSA-2024:4457
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.2 Extended Update Support
Via RHSA-2024:4716 https://access.redhat.
Bugzilla
CVE-2024-6387 openssh: regreSSHion - race condition in SSH allows RCE/DoS
bugzilla·2024-06-27·CVSS 8.1
CVE-2024-6387 [HIGH] CVE-2024-6387 openssh: regreSSHion - race condition in SSH allows RCE/DoS
CVE-2024-6387 openssh: regreSSHion - race condition in SSH allows RCE/DoS
We discovered a vulnerability (a signal handler race condition) in OpenSSH's server (sshd): if a client does not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's SIGALRM handler is called asynchronously, but this signal handler calls various functions that are not async-signal-safe (for example, syslog()).
On investigation, we realized that this vulnerability is in fact a regression of CVE-2006-5051 ("Signal handler race condition in OpenSSH
before 4.4 allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code"), which was reported in 2006 by
Mark Dowd.
This regression was introduced in October 2020 (OpenSSH 8.5p1) by commi
https://access.redhat.com/errata/RHSA-2024:4312https://access.redhat.com/errata/RHSA-2024:4340https://access.redhat.com/errata/RHSA-2024:4389https://access.redhat.com/errata/RHSA-2024:4469https://access.redhat.com/errata/RHSA-2024:4474https://access.redhat.com/errata/RHSA-2024:4479https://access.redhat.com/errata/RHSA-2024:4484https://access.redhat.com/security/cve/CVE-2024-6387https://bugzilla.redhat.com/show_bug.cgi?id=2294604https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlhttps://www.openssh.com/txt/release-9.8https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txthttp://seclists.org/fulldisclosure/2024/Jul/18http://seclists.org/fulldisclosure/2024/Jul/19http://seclists.org/fulldisclosure/2024/Jul/20http://www.openwall.com/lists/oss-security/2024/07/01/12http://www.openwall.com/lists/oss-security/2024/07/01/13http://www.openwall.com/lists/oss-security/2024/07/02/1http://www.openwall.com/lists/oss-security/2024/07/03/1http://www.openwall.com/lists/oss-security/2024/07/03/11http://www.openwall.com/lists/oss-security/2024/07/03/2http://www.openwall.com/lists/oss-security/2024/07/03/3http://www.openwall.com/lists/oss-security/2024/07/03/4http://www.openwall.com/lists/oss-security/2024/07/03/5http://www.openwall.com/lists/oss-security/2024/07/04/1http://www.openwall.com/lists/oss-security/2024/07/04/2http://www.openwall.com/lists/oss-security/2024/07/08/2http://www.openwall.com/lists/oss-security/2024/07/08/3http://www.openwall.com/lists/oss-security/2024/07/09/2http://www.openwall.com/lists/oss-security/2024/07/09/5http://www.openwall.com/lists/oss-security/2024/07/10/1http://www.openwall.com/lists/oss-security/2024/07/10/2http://www.openwall.com/lists/oss-security/2024/07/10/3http://www.openwall.com/lists/oss-security/2024/07/10/4http://www.openwall.com/lists/oss-security/2024/07/10/6http://www.openwall.com/lists/oss-security/2024/07/11/1http://www.openwall.com/lists/oss-security/2024/07/11/3http://www.openwall.com/lists/oss-security/2024/07/23/4http://www.openwall.com/lists/oss-security/2024/07/23/6http://www.openwall.com/lists/oss-security/2024/07/28/2http://www.openwall.com/lists/oss-security/2024/07/28/3https://access.redhat.com/errata/RHSA-2024:4312https://access.redhat.com/errata/RHSA-2024:4340https://access.redhat.com/errata/RHSA-2024:4389https://access.redhat.com/errata/RHSA-2024:4469https://access.redhat.com/errata/RHSA-2024:4474https://access.redhat.com/errata/RHSA-2024:4479https://access.redhat.com/errata/RHSA-2024:4484https://access.redhat.com/security/cve/CVE-2024-6387https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-serverhttps://bugzilla.redhat.com/show_bug.cgi?id=2294604https://explore.alas.aws.amazon.com/CVE-2024-6387.htmlhttps://forum.vmssoftware.com/viewtopic.php?f=8&t=9132https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.aschttps://github.com/AlmaLinux/updates/issues/629https://github.com/Azure/AKS/issues/4379https://github.com/PowerShell/Win32-OpenSSH/discussions/2248https://github.com/PowerShell/Win32-OpenSSH/issues/2249https://github.com/microsoft/azurelinux/issues/9555https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09https://github.com/oracle/oracle-linux/issues/149https://github.com/rapier1/hpn-ssh/issues/87https://github.com/zgzhang/cve-2024-6387-pochttps://lists.almalinux.org/archives/list/[email protected]/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.htmlhttps://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.htmlhttps://news.ycombinator.com/item?id=40843778https://packetstorm.news/files/id/190587/https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlhttps://security-tracker.debian.org/tracker/CVE-2024-6387https://security.netapp.com/advisory/ntap-20240701-0001/https://sig-security.rocky.page/issues/CVE-2024-6387/https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/https://support.apple.com/kb/HT214118https://support.apple.com/kb/HT214119https://support.apple.com/kb/HT214120https://ubuntu.com/security/CVE-2024-6387https://ubuntu.com/security/notices/USN-6859-1https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-dohttps://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100https://www.exploit-db.com/exploits/52269https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.aschttps://www.openssh.com/txt/release-9.8https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txthttps://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.htmlhttps://www.suse.com/security/cve/CVE-2024-6387.htmlhttps://www.theregister.com/2024/07/01/regresshion_openssh/https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-446545.html
2024-07-01
Published
Exploited in the wild