CVE-2024-6387
01.07.2024, 13:15
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
| Vendor | Product | Version |
|---|---|---|
| openbsd | openssh | 𝑥 < 4.4 |
| openbsd | openssh | 8.6 ≤ 𝑥 < 9.8 |
| openbsd | openssh | 4.4 |
| openbsd | openssh | 8.5:p1 |
| redhat | openshift_container_platform | 4.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux_eus | 9.4 |
| redhat | enterprise_linux_for_arm_64 | 9.0_aarch64:_aarch64 |
| redhat | enterprise_linux_for_arm_64_eus | 9.4_aarch64:_aarch64 |
| redhat | enterprise_linux_for_ibm_z_systems | 9.0_s390x:_s390x |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.4_s390x:_s390x |
| redhat | enterprise_linux_for_power_little_endian | 9.0_ppc64le:_ppc64le |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.4_ppc64le:_ppc64le |
| redhat | enterprise_linux_server_aus | 9.4 |
| suse | linux_enterprise_micro | 6.0 |
| debian | debian_linux | 12.0 |
| canonical | ubuntu_linux | 22.04 |
| canonical | ubuntu_linux | 22.10 |
| canonical | ubuntu_linux | 23.04 |
| amazon | linux_2023 | - |
| netapp | e-series_santricity_os_controller | 11.0.0 ≤ 𝑥 ≤ 11.70.2 |
| netapp | ontap_select_deploy_administration_utility | - |
| freebsd | freebsd | 13.2 |
| freebsd | freebsd | 13.2:p1 |
| freebsd | freebsd | 13.2:p10 |
| freebsd | freebsd | 13.2:p11 |
| freebsd | freebsd | 13.2:p2 |
| freebsd | freebsd | 13.2:p3 |
| freebsd | freebsd | 13.2:p4 |
| freebsd | freebsd | 13.2:p5 |
| freebsd | freebsd | 13.2:p6 |
| freebsd | freebsd | 13.2:p7 |
| freebsd | freebsd | 13.2:p8 |
| freebsd | freebsd | 13.2:p9 |
| freebsd | freebsd | 13.3 |
| freebsd | freebsd | 13.3:p1 |
| freebsd | freebsd | 13.3:p2 |
| freebsd | freebsd | 13.3:p3 |
| freebsd | freebsd | 14.0 |
| freebsd | freebsd | 14.0:beta5 |
| freebsd | freebsd | 14.0:p1 |
| freebsd | freebsd | 14.0:p2 |
| freebsd | freebsd | 14.0:p3 |
| freebsd | freebsd | 14.0:p4 |
| freebsd | freebsd | 14.0:p5 |
| freebsd | freebsd | 14.0:p6 |
| freebsd | freebsd | 14.0:p7 |
| freebsd | freebsd | 14.0:rc3 |
| freebsd | freebsd | 14.0:rc4-p1 |
| freebsd | freebsd | 14.1 |
| freebsd | freebsd | 14.1:p1 |
| netbsd | netbsd | 𝑥 ≤ 10.0.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openssh |
| ||||||||||||||
| openssh-ssh1 |
|
Common Weakness Enumeration
- CWE-364 - Signal Handler Race ConditionThe software uses a signal handler that introduces a race condition.
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
References