CVE-2024-6387: Openssh: regresshion - race condition in ssh allows rce/dos

8.1 CVSS

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Classification

CVE ID: CVE-2024-6387

CVSS Base Severity: HIGH

CVSS Base Score: 8.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem Types

Signal Handler Race Condition

Affected Products

Vendor: , Red Hat

Product: , Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8

Exploit Prediction Scoring System (EPSS)

EPSS Score: 54.04% (probability of being exploited)

EPSS Percentile: 97.83% (scored less or equal to compared to others)

EPSS Date: 2025-05-15 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: poc

SSVC Technical Impact: total

SSVC Automatable: false

References

Timeline

2025-04-10 19:30:45 UTC
All CISA Advisories

ABB Arctic Wireless Gateways
2025-04-24 19:40:18 UTC
CVE

Openssh: regresshion - race condition in ssh allows rce/dos