{"id":"CVE-2024-6387","published":"2024-07-01T12:37:25Z","modified":"2026-10-15T02:04:17Z","title":"Openssh: regresshion - race condition in ssh allows rce/dos","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","tier":"core","eol":null,"affectedVersions":[{"vendor":null,"product":null,"versions":[">= 8.5p1, <= 9.7p1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","versions":["all versions"]}],"description":{"text":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a race condition in the sshd server component of OpenSSH, as shipped in Red Hat Enterprise Linux 9, where some signals are handled in an unsafe manner. An unauthenticated remote attacker can trigger it by failing to authenticate within a set time period, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:37Z"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.99506,"percentile":0.99946,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-07-17","exploitedFirstSeen":"2024-07-17","ransomware":false,"evidence":[{"url":"https://www.cadosecurity.com/blog/warpscan-cloudflare-warp-abused-to-hijack-cloud-services-blog","date":"2024-07-17"},{"url":"https://content.kaspersky-labs.com/fm/site-editor/33/3318ec849851138088d24f26d236f469/source/irreport.pdf","date":"2025-03-12"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2024-6387","date":"2025-06-07"},{"url":"https://www.aquasec.com/blog/kaiji-malware-anatomy-persistence-detection/","date":"2025-10-14"},{"url":"https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/","date":"2026-08-13"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-364","name":"Signal Handler Race Condition"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4312","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4340","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4389","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4469","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4474","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4479","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4484","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6387","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2294604","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://santandersecurityresearch.github.io/blog/sshing_the_masses.html","tags":[]},{"url":"https://www.openssh.com/txt/release-9.8","tags":[]},{"url":"https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt","tags":[]},{"url":"https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387","tags":[]},{"url":"https://www.exploit-db.com/exploits/52269","tags":[]},{"url":"https://packetstorm.news/files/id/190587/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/12","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/01/13","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/02/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/11","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/3","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/4","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/04/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/04/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/08/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/08/3","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/3","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/4","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/6","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/11/3","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/4","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/23/6","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/28/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/28/3","tags":["x_transferred"]},{"url":"https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/","tags":["x_transferred"]},{"url":"https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/","tags":["x_transferred"]},{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server","tags":["x_transferred"]},{"url":"https://explore.alas.aws.amazon.com/CVE-2024-6387.html","tags":["x_transferred"]},{"url":"https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132","tags":["x_transferred"]},{"url":"https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc","tags":["x_transferred"]},{"url":"https://github.com/AlmaLinux/updates/issues/629","tags":["x_transferred"]},{"url":"https://github.com/Azure/AKS/issues/4379","tags":["x_transferred"]},{"url":"https://github.com/PowerShell/Win32-OpenSSH/discussions/2248","tags":["x_transferred"]},{"url":"https://github.com/PowerShell/Win32-OpenSSH/issues/2249","tags":["x_transferred"]},{"url":"https://github.com/microsoft/azurelinux/issues/9555","tags":["x_transferred"]},{"url":"https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09","tags":["x_transferred"]},{"url":"https://github.com/oracle/oracle-linux/issues/149","tags":["x_transferred"]},{"url":"https://github.com/rapier1/hpn-ssh/issues/87","tags":["x_transferred"]},{"url":"https://github.com/zgzhang/cve-2024-6387-poc","tags":["x_transferred"]},{"url":"https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/","tags":["x_transferred"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html","tags":["x_transferred"]},{"url":"https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html","tags":["x_transferred"]},{"url":"https://news.ycombinator.com/item?id=40843778","tags":["x_transferred"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6387","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240701-0001/","tags":["x_transferred"]},{"url":"https://sig-security.rocky.page/issues/CVE-2024-6387/","tags":["x_transferred"]},{"url":"https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2024-6387","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/notices/USN-6859-1","tags":["x_transferred"]},{"url":"https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do","tags":["x_transferred"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100","tags":["x_transferred"]},{"url":"https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc","tags":["x_transferred"]},{"url":"https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html","tags":["x_transferred"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6387.html","tags":["x_transferred"]},{"url":"https://www.theregister.com/2024/07/01/regresshion_openssh/","tags":["x_transferred"]},{"url":"https://support.apple.com/kb/HT214119","tags":["x_transferred"]},{"url":"https://support.apple.com/kb/HT214118","tags":["x_transferred"]},{"url":"https://support.apple.com/kb/HT214120","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/20","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/18","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Jul/19","tags":["x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-446545.html","tags":[]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-47981","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47981","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52269,"url":"https://www.exploit-db.com/exploits/52269","title":"OpenSSH server (sshd) 9.8p1 - Race Condition","type":"remote","platform":"linux","date":"2025-04-22","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-22"},"pocGithub":{"count":82,"skipped":15,"earliest":"2024-07-01","earliestUrl":"https://github.com/7etsuo/cve-2024-6387-poc","repos":[{"name":"xaitax/CVE-2024-6387_Check","url":"https://github.com/xaitax/CVE-2024-6387_Check","stars":527,"created":"2024-07-01"},{"name":"zgzhang/cve-2024-6387-poc","url":"https://github.com/zgzhang/cve-2024-6387-poc","stars":497,"created":"2024-07-01"},{"name":"acrono/cve-2024-6387-poc","url":"https://github.com/acrono/cve-2024-6387-poc","stars":375,"created":"2024-07-01"},{"name":"Karmakstylez/CVE-2024-6387","url":"https://github.com/Karmakstylez/CVE-2024-6387","stars":199,"created":"2024-07-08"},{"name":"lflare/cve-2024-6387-poc","url":"https://github.com/lflare/cve-2024-6387-poc","stars":129,"created":"2024-07-01"}]},"first":{"date":"2024-07-01","source":"PoC-in-GitHub","url":"https://github.com/7etsuo/cve-2024-6387-poc"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/52269","https://packetstorm.news/files/id/190587/","https://github.com/zgzhang/cve-2024-6387-poc"],"flow":[],"timeline":[{"date":"2024-07-01","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-6387","provenance":"source"},{"date":"2024-07-01","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-04-22","url":"https://github.com/7etsuo/cve-2024-6387-poc","provenance":"source"},{"date":"2024-07-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cadosecurity.com/blog/warpscan-cloudflare-warp-abused-to-hijack-cloud-services-blog","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":65.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 837 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 3 NVD exploit links; 82 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":5.67,"detail":"base score 8.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-red-hat-enterprise-linux-9-cve-2006-5051","parents":[{"from":"CVE-2006-5051","to":"CVE-2024-6387","relation":"regression","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"regression","quote":"A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd).","from":"CVE.org","in":"CVE-2024-6387"}]}],"children":[{"from":"CVE-2024-6387","to":"CVE-2024-7589","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh.","from":"CVE.org","in":"CVE-2024-7589"}]}]}}