7

CVE-2024-6409

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://www.openssh.com/
≫
Paket OpenSSH
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version < *
Version 0:8.7p1-38.el9_4.4
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9
Default Statusaffected
Version < *
Version 0:8.7p1-38.el9_4.4
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Default Statusaffected
Version < *
Version 0:8.7p1-12.el9_0.3
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 9.2 Extended Update Support
Default Statusaffected
Version < *
Version 0:8.7p1-30.el9_2.7
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.13
Default Statusaffected
Version < *
Version 413.92.202408122222-0
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version < *
Version 414.92.202407300859-0
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.15
Default Statusaffected
Version < *
Version 415.92.202407301159-0
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version < *
Version 416.94.202407171205-0
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 10
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 6
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 7
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat Enterprise Linux 8
Default Statusunaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 78.16% 0.99
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
secalert@redhat.com 7 2.2 4.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE-364 Signal Handler Race Condition

The product uses a signal handler that introduces a race condition.