Junglewise Threat Intelligence

CVE-2024-6387: OpenSSH remote code execution in sshd signal handling

CVE-2024-6387 · Severity: high · CVSS 8.1 · Published 2024-07-01

Technologies: Red Hat Enterprise Linux, Openssh. Vendors: Red Hat.

Executive brief

A critical vulnerability has been identified in OpenSSH, a widely used tool for secure remote access to servers. An attacker could exploit this flaw to gain full administrative control over a target system without needing a password. This could lead to complete data theft, system outages, or the installation of persistent malware across corporate infrastructure.

Technical details

A race condition exists in the OpenSSH server (sshd) when handling SIGALRM signals during the authentication phase. If a client fails to authenticate within the LoginGraceTime (default 120 seconds), the SIGALRM handler is executed; however, this handler calls functions that are not async-signal-safe (such as syslog()). An attacker can exploit this by carefully timing a connection to trigger the race condition, leading to unauthenticated remote code execution with root privileges. This is a regression of CVE-2006-5051 and affects OpenSSH versions between 8.5p1 and 9.7p1. Patches are available from major Linux distributions including Red Hat.

Affected products

  • Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6
  • OpenSSH OpenSSH 8.5p1 to 9.7p1

Timeline

  • 2024-07-01: disclosed: Initial public disclosure of the vulnerability
  • 2024-07-03: patched: Red Hat released initial security updates for RHEL 9

References