CVE-2024-6409: Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
Other sources
The OpenSSH version as shipped with Red Hat Enterprise Linux 9 is vulnerable to a signal handler race condition on cleanupexit() function which introduces the same vulnerability as CVE-2024-6387 in the unprivileged child of the SSHD server. This vulnerability only affects the versions of OpenSSH shipped with Red Hat Enterprise Linux 9.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u3Fixed in 1:8.4p1-5+deb11u7Fixed in 1:9.2p1-2+deb12u10Fixed in 1:9.2p1-2+deb12u9Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.0p1-7+deb13u2Fixed in 1:10.3p1-5Fixed in 1:10.4p1-1 - Upgrade
Upgrade
openssh (sshd) on Red Hat Enterprise Linux 9to a version that resolves this vulnerability.Patch CVE-2024-6387
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6409?
CVE-2024-6409 is considered to be a high severity vulnerability due to its potential to allow remote attackers to exploit the race condition in OpenSSH's server.
How do I fix CVE-2024-6409?
To remediate CVE-2024-6409, update OpenSSH to one of the patched versions: 1:8.4p1-5+deb11u3, 1:9.2p1-2+deb12u3, or 1:9.8p1-8.
Which software is affected by CVE-2024-6409?
CVE-2024-6409 affects OpenSSH server versions, as well as specific versions of F5 BIG-IP Next SPK and F5 BIG-IP Next CNF.
Can CVE-2024-6409 be exploited remotely?
Yes, CVE-2024-6409 can be exploited remotely by attackers without authentication for a limited time.
What type of vulnerability is CVE-2024-6409?
CVE-2024-6409 is classified as a race condition vulnerability related to signal handling in the OpenSSH server.