CVE-2024-6409
HIGHDescription
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
CVSS v3.1 Score
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2024-6409? +
How severe is CVE-2024-6409? +
How do I check if I'm vulnerable to CVE-2024-6409? +
Related Vulnerabilities
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to …
in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when …
Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in …
Concurrency and locking defects in GSS-TSIG
in OpenHarmony v6.0 and prior versions allow a local attacker cause information leak.