{"id":"CVE-2024-6409","published":"2024-07-08T17:57:10Z","modified":"2026-10-15T02:04:32Z","title":"Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","tier":"core","eol":null,"affectedVersions":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Extended Update Support","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","versions":["all versions"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","versions":["all versions"]}],"description":{"text":"A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.27935,"percentile":0.98095,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-03-12","exploitedFirstSeen":"2025-03-12","ransomware":false,"evidence":[{"url":"https://content.kaspersky-labs.com/fm/site-editor/33/3318ec849851138088d24f26d236f469/source/irreport.pdf","date":"2025-03-12"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"New Play Ransomware Linux Variant Targets ESXi Shows Ties With Prolific Puma | Trend Micro (US)","url":"https://otx.alienvault.com/pulse/669f686546d076e924186daa","created":"2024-07-23"},{"name":"New Play Ransomware Linux Variant Targets ESXi Shows Ties With Prolific Puma | Trend Micro (US)","url":"https://otx.alienvault.com/pulse/669e538c27238f02ad6143d8","created":"2024-07-22"},{"name":"New Play Ransomware Linux Variant Targets ESXi Shows Ties With Prolific Puma | Trend Micro (US)","url":"https://otx.alienvault.com/pulse/669e1449d7001e79b6076656","created":"2024-07-22"},{"name":"Play Ransomware Group’s New Linux Variant Targets ESXi, Shows Ties With Prolific Puma","url":"https://otx.alienvault.com/pulse/669a17cfbd15e293ecf1e5cf","created":"2024-07-19"},{"name":"PHP Vulnerability CVE-2024-4577 Actively Exploited in the Wild","url":"https://otx.alienvault.com/pulse/66911e9c281ef0fb7bda2508","created":"2024-07-12"}],"provenance":"machine"},"cwes":[{"id":"CWE-364","name":"Signal Handler Race Condition"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:4457","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4613","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4716","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4910","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4955","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4960","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2024:5444","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-6409","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2295085","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/08/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/2","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/09/5","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/1","tags":["x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/10/2","tags":["x_transferred"]},{"url":"https://almalinux.org/blog/2024-07-09-cve-2024-6409/","tags":["x_transferred"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1227217","tags":["x_transferred"]},{"url":"https://explore.alas.aws.amazon.com/CVE-2024-6409.html","tags":["x_transferred"]},{"url":"https://github.com/openela-main/openssh/commit/c00da7741d42029e49047dd89e266d91dcfbffa0","tags":["x_transferred"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6409","tags":["x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20240712-0003/","tags":["x_transferred"]},{"url":"https://sig-security.rocky.page/issues/CVE-2024-6409/","tags":["x_transferred"]},{"url":"https://ubuntu.com/security/CVE-2024-6409","tags":["x_transferred"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6409.html","tags":["x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-47983","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-47983","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-07-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-6409","provenance":"source"},{"date":"2025-03-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://content.kaspersky-labs.com/fm/site-editor/33/3318ec849851138088d24f26d236f469/source/irreport.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":61.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 597 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.62,"detail":"percentile 0.9809"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}