Vulnerability · Published Jul 1, 2024 · Assigned by redhat
CVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos
High 8.1
In plain English
A high-severity security flaw in OpenSSH. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 99.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)99.5%top 0.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | openssh | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux:9 | openssh-askpass | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux:9 | openssh-clients | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux:9 | openssh-keycat | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux:9 | openssh-server | 8.7p1-38.el9_4.1 | ALSA-2024:4312 |
| AlmaLinux:9 | pam_ssh_agent_auth | 0.10.4-5.38.el9_4.1 | ALSA-2024:4312 |
| Alpine:v3.20 | openssh | 9.7_p1-r4 | ALPINE-CVE-2024-6387 |
| Alpine:v3.21 | openssh | 9.8_p1-r0 | ALPINE-CVE-2024-6387 |
| Alpine:v3.22 | openssh | 9.8_p1-r0 | ALPINE-CVE-2024-6387 |
| Alpine:v3.23 | openssh | 9.8_p1-r0 | ALPINE-CVE-2024-6387 |
| Alpine:v3.24 | openssh | 9.8_p1-r0 | ALPINE-CVE-2024-6387 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u3 | DSA-5724-1 |
| Debian:12 | openssh | 1:9.2p1-2+deb12u3 | DEBIAN-CVE-2024-6387 |
| Debian:13 | openssh | 1:9.7p1-7 | DEBIAN-CVE-2024-6387 |
| Debian:14 | openssh | 1:9.7p1-7 | DEBIAN-CVE-2024-6387 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.10 | UBUNTU-CVE-2024-6387 |
| Ubuntu:22.04:LTS | openssh | 1:8.9p1-3ubuntu0.10 | USN-6859-1 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.3 | UBUNTU-CVE-2024-6387 |
| Ubuntu:24.04:LTS | openssh | 1:9.6p1-3ubuntu13.3 | USN-6859-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenSSH | 8.5p1 – through 9.7p1 | |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | see references |
| Red Hat | Red Hat Ceph Storage 5 | see references |
| Red Hat | Red Hat Ceph Storage 6 | see references |
| Red Hat | Red Hat Ceph Storage 7 | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 6 | see references |
| Red Hat | Red Hat Enterprise Linux 7 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat OpenShift Container Platform 4 | see references |
Weakness: CWE-364 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2024:4312 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4340 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4389 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4469 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4474 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4479 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:4484 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-6387 vdb-entry, x_refsource_REDHAT
- RHBZ#2294604 issue-tracking, x_refsource_REDHAT
- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
- https://www.openssh.com/txt/release-9.8
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
- https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
- https://www.exploit-db.com/exploits/52269
- https://packetstorm.news/files/id/190587/
- http://www.openwall.com/lists/oss-security/2024/07/01/12 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/01/13 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/02/1 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/1 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/11 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/2 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/3 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/4 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/03/5 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/04/1 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/04/2 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/08/2 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/08/3 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/09/2 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/09/5 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/10/1 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/10/2 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/10/3 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/10/4 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/10/6 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/11/1 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/11/3 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/23/4 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/23/6 x_transferred
- http://www.openwall.com/lists/oss-security/2024/07/28/2 x_transferred