Openssh: regresshion - race condition in ssh allows rce/dos
Red Hat · Red Hat Enterprise Linux 9
The flaw is a race condition in the sshd server component of OpenSSH, as shipped in Red Hat Enterprise Linux 9, where some signals are handled in an unsafe manner. An unauthenticated remote attacker can trigger it by failing to authenticate within a set time period, with no user interaction required.
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 16 days after disclosure. Public exploit code (PoC-in-GitHub) was available the same day.
- First seen exploitedVulnCheck KEV evidence+16 days
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete 2 times over 18 years.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
NOTE: this issue exists because of an incorrect fix for CVE-2006-5051.
- Stated in the CVE text
- same familyThis CVECVE-2024-6387Openssh: regresshion - race condition in ssh allows rce/dos1 Jul 2024
variant in the same codeHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh.
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight21 Sep 2026
- EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight18 Sep 2026
- New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure17 Aug 2026
- PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure17 Aug 2026
- PATCHCORD: New malware cluster targets Afghan telecom and South Asian critical infrastructure13 Aug 2026
- vip heytap28 Jun 2026
- 44 more on OTX