Is CVE-2024-6387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6387 being exploited in the wild.

How severe is CVE-2024-6387?

High severity, with a CVSS score of 8.1, published 1 July 2024.

Which products and versions are affected?

Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6; OpenSSH OpenSSH 8.5p1 to 9.7p1.

Is there a fix for CVE-2024-6387?

A patch was published on 2024-07-03: Red Hat released initial security updates for RHEL 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6387 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2024-6387?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6387: OpenSSH remote code execution in sshd signal handling

CVE-2024-6387 · Severity: high · CVSS 8.1 · Published 2024-07-01

A critical vulnerability has been identified in OpenSSH, a widely used tool for secure remote access to servers. An attacker could exploit this flaw to gain full administrative control over a target system without needing a password. This could lead to complete data theft, system outages, or the installation of persistent malware across corporate infrastructure.

Quick answers

Is CVE-2024-6387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6387 being exploited in the wild.
How severe is CVE-2024-6387?: High severity, with a CVSS score of 8.1, published 1 July 2024.
Which products and versions are affected?: Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6; OpenSSH OpenSSH 8.5p1 to 9.7p1.
Is there a fix for CVE-2024-6387?: A patch was published on 2024-07-03: Red Hat released initial security updates for RHEL 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6387 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2024-6387?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in the OpenSSH server (sshd) when handling SIGALRM signals during the authentication phase. If a client fails to authenticate within the LoginGraceTime (default 120 seconds), the SIGALRM handler is executed; however, this handler calls functions that are not async-signal-safe (such as syslog()). An attacker can exploit this by carefully timing a connection to trigger the race condition, leading to unauthenticated remote code execution with root privileges. This is a regression of CVE-2006-5051 and affects OpenSSH versions between 8.5p1 and 9.7p1. Patches are available from major Linux distributions including Red Hat.

Affected products

Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6
OpenSSH OpenSSH 8.5p1 to 9.7p1

Timeline

2024-07-01: disclosed: Initial public disclosure of the vulnerability
2024-07-03: patched: Red Hat released initial security updates for RHEL 9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.