# CVE-2024-6387: OpenSSH remote code execution in sshd signal handling

Source: https://junglewise.ai/threats/cve-2024-6387-openssh-remote-code-execution-in-sshd-signal-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-07-01. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2024-6387 · Severity: high · CVSS 8.1 · Published 2024-07-01

A critical vulnerability has been identified in OpenSSH, a widely used tool for secure remote access to servers. An attacker could exploit this flaw to gain full administrative control over a target system without needing a password. This could lead to complete data theft, system outages, or the installation of persistent malware across corporate infrastructure.

## Quick answers

**Is CVE-2024-6387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6387 being exploited in the wild.

**How severe is CVE-2024-6387?** High severity, with a CVSS score of 8.1, published 1 July 2024.

**Which products and versions are affected?** Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6; OpenSSH OpenSSH 8.5p1 to 9.7p1.

**Is there a fix for CVE-2024-6387?** A patch was published on 2024-07-03: Red Hat released initial security updates for RHEL 9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6387 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2024-6387?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the OpenSSH server (sshd) when handling SIGALRM signals during the authentication phase. If a client fails to authenticate within the LoginGraceTime (default 120 seconds), the SIGALRM handler is executed; however, this handler calls functions that are not async-signal-safe (such as syslog()). An attacker can exploit this by carefully timing a connection to trigger the race condition, leading to unauthenticated remote code execution with root privileges. This is a regression of CVE-2006-5051 and affects OpenSSH versions between 8.5p1 and 9.7p1. Patches are available from major Linux distributions including Red Hat.

## Affected products

- Red Hat Enterprise Linux 9.0, 9.2, 9.4, 9.6
- OpenSSH OpenSSH 8.5p1 to 9.7p1

## Timeline

- 2024-07-01: disclosed: Initial public disclosure of the vulnerability
- 2024-07-03: patched: Red Hat released initial security updates for RHEL 9

## References

- [https://access.redhat.com/errata/RHSA-2024:4312](https://access.redhat.com/errata/RHSA-2024:4312)
- [https://access.redhat.com/errata/RHSA-2024:4340](https://access.redhat.com/errata/RHSA-2024:4340)
- [https://access.redhat.com/errata/RHSA-2024:4389](https://access.redhat.com/errata/RHSA-2024:4389)
- [https://access.redhat.com/errata/RHSA-2024:4469](https://access.redhat.com/errata/RHSA-2024:4469)
- [https://access.redhat.com/errata/RHSA-2024:4474](https://access.redhat.com/errata/RHSA-2024:4474)
- [https://access.redhat.com/errata/RHSA-2024:4479](https://access.redhat.com/errata/RHSA-2024:4479)
- [https://access.redhat.com/errata/RHSA-2024:4484](https://access.redhat.com/errata/RHSA-2024:4484)