erroneo.us
Search all guides⌘K

Security Digest · Vulnerability record

CVE-2024-6387: Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).

CVSS 8.1 High EPSS 99.5% · p99.9 Patch this week

Updated By erroneo.us Security Desk83 references

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

  • Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
  • EPSS 99.5%, percentile 99.9: FIRST’s model estimates a 99.5% chance of exploitation activity in the next 30 days, higher than 99.9% of all scored CVEs (very high). EPSS is a probability, not a verdict.
  • Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
  • Editorial verdict: Patch this week. regreSSHion: OpenSSH sshd Signal Race RCE (CVE-2024-6387) — Serious on paper (unauthenticated root RCE in sshd), but the only demonstrated exploit needed a 32-bit glibc target and 6-8 hours of continuous connections in a lab, so patch promptly through your distro instead of panicking.

What it is

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Weakness type: CWE-364.

Product: OpenSSH · Assigned by: redhat · Published: 2024-07-01

Affected and fixed versions

VendorProductAffected versions (per CVE record)
OpenSSH8.5p1 <= 9.7p1
Red HatRed Hat Enterprise Linux 9see vendor advisory
Red HatRed Hat Enterprise Linux 9see vendor advisory
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutionssee vendor advisory
Red HatRed Hat Enterprise Linux 9.2 Extended Update Supportsee vendor advisory
Red HatRed Hat OpenShift Container Platform 4.13see vendor advisory
Red HatRed Hat OpenShift Container Platform 4.14see vendor advisory
Red HatRed Hat OpenShift Container Platform 4.15see vendor advisory
Red HatRed Hat OpenShift Container Platform 4.16see vendor advisory
Red HatRed Hat Ceph Storage 5see vendor advisory

Severity scores

Scored byCVSSScoreVector
redhat3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Attack vector: network (remotely reachable)
  • Attack complexity: high (needs special conditions)
  • Privileges required: none (no login)
  • User interaction: none
  • Scope: unchanged

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

  • CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
  • CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
  • FIRST EPSS (model of 2026-10-21): 99.51% probability of exploitation activity in the next 30 days; percentile 99.9.

Timeline

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

  1. RHSA-2024:4312 access.redhat.com
  2. RHSA-2024:4340 access.redhat.com
  3. RHSA-2024:4389 access.redhat.com
  4. RHSA-2024:4469 access.redhat.com
  5. RHSA-2024:4474 access.redhat.com
  6. RHSA-2024:4479 access.redhat.com
  7. RHSA-2024:4484 access.redhat.com

Vulnerability records

  1. CVE.org record CVE-2024-6387 cve.org
  2. NVD entry CVE-2024-6387 nvd.nist.gov

Other references from the CVE record and advisory

  1. access.redhat.com access.redhat.com
  2. RHBZ#2294604 bugzilla.redhat.com
  3. santandersecurityresearch.github.io santandersecurityresearch.github.io
  4. openssh.com openssh.com
  5. qualys.com qualys.com
  6. vicarius.io vicarius.io
  7. exploit-db.com exploit-db.com
  8. packetstorm.news packetstorm.news
  9. openwall.com openwall.com
  10. openwall.com openwall.com
  11. openwall.com openwall.com
  12. openwall.com openwall.com
  13. openwall.com openwall.com
  14. openwall.com openwall.com
  15. openwall.com openwall.com
  16. openwall.com openwall.com
  17. openwall.com openwall.com
  18. openwall.com openwall.com
  19. openwall.com openwall.com
  20. openwall.com openwall.com
  21. openwall.com openwall.com
  22. openwall.com openwall.com
  23. openwall.com openwall.com
  24. openwall.com openwall.com
  25. openwall.com openwall.com
  26. openwall.com openwall.com
  27. openwall.com openwall.com
  28. openwall.com openwall.com
  29. openwall.com openwall.com
  30. openwall.com openwall.com
  31. openwall.com openwall.com
  32. openwall.com openwall.com
  33. openwall.com openwall.com
  34. openwall.com openwall.com
  35. archlinux.org archlinux.org
  36. arstechnica.com arstechnica.com
  37. blog.qualys.com blog.qualys.com
  38. explore.alas.aws.amazon.com explore.alas.aws.amazon.com
  39. forum.vmssoftware.com forum.vmssoftware.com
  40. ftp.netbsd.org ftp.netbsd.org
  41. github.com github.com
  42. github.com github.com
  43. github.com github.com
  44. github.com github.com
  45. github.com github.com
  46. github.com github.com
  47. github.com github.com
  48. github.com github.com
  49. github.com github.com
  50. lists.almalinux.org lists.almalinux.org
  51. lists.mindrot.org lists.mindrot.org
  52. lists.mindrot.org lists.mindrot.org
  53. news.ycombinator.com news.ycombinator.com
  54. psirt.global.sonicwall.com psirt.global.sonicwall.com
  55. security-tracker.debian.org security-tracker.debian.org
  56. security.netapp.com security.netapp.com
  57. sig-security.rocky.page sig-security.rocky.page
  58. stackdiary.com stackdiary.com
  59. ubuntu.com ubuntu.com
  60. ubuntu.com ubuntu.com
  61. akamai.com akamai.com
  62. arista.com arista.com
  63. freebsd.org freebsd.org
  64. splunk.com splunk.com
  65. suse.com suse.com
  66. theregister.com theregister.com
  67. support.apple.com support.apple.com
  68. support.apple.com support.apple.com
  69. support.apple.com support.apple.com
  70. seclists.org seclists.org
  71. seclists.org seclists.org
  72. seclists.org seclists.org
  73. cert-portal.siemens.com cert-portal.siemens.com
  74. cert-portal.siemens.com cert-portal.siemens.com

Today’s Security Digest