CVE-2024-6409
Estado: AplazadaAlta (7)—
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- Puntuación base: 7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 28%
- Percentil entre todas las CVEs puntuadas: 98
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-364
Referencias
- https://access.redhat.com/errata/RHSA-2024:4457
- https://access.redhat.com/errata/RHSA-2024:4613
- https://access.redhat.com/errata/RHSA-2024:4716
- https://access.redhat.com/errata/RHSA-2024:4910
- https://access.redhat.com/errata/RHSA-2024:4955
- https://access.redhat.com/errata/RHSA-2024:4960
- https://access.redhat.com/errata/RHSA-2024:5444
- https://access.redhat.com/security/cve/CVE-2024-6409
- https://bugzilla.redhat.com/show_bug.cgi?id=2295085
- http://www.openwall.com/lists/oss-security/2024/07/08/2
- http://www.openwall.com/lists/oss-security/2024/07/09/2
- http://www.openwall.com/lists/oss-security/2024/07/09/5
- http://www.openwall.com/lists/oss-security/2024/07/10/1
- http://www.openwall.com/lists/oss-security/2024/07/10/2
- https://access.redhat.com/errata/RHSA-2024:4457
- https://access.redhat.com/errata/RHSA-2024:4613
- https://access.redhat.com/errata/RHSA-2024:4716
- https://access.redhat.com/security/cve/CVE-2024-6409
- https://almalinux.org/blog/2024-07-09-cve-2024-6409/
- https://bugzilla.redhat.com/show_bug.cgi?id=2295085
- https://bugzilla.suse.com/show_bug.cgi?id=1227217
- https://explore.alas.aws.amazon.com/CVE-2024-6409.html
- https://github.com/openela-main/openssh/commit/c00da7741d42029e49047dd89e266d91dcfbffa0
- https://security-tracker.debian.org/tracker/CVE-2024-6409
- https://security.netapp.com/advisory/ntap-20240712-0003/
- https://sig-security.rocky.page/issues/CVE-2024-6409/
- https://ubuntu.com/security/CVE-2024-6409
- https://www.suse.com/security/cve/CVE-2024-6409.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-6409",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-6409",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-07-11T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 4.7,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"repo": "https://anongit.mindrot.org/openssh.git",
"packageName": "OpenSSH",
"collectionURL": "https://www.openssh.com/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:8.7p1-38.el9_4.4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:8.7p1-38.el9_4.4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream",
"cpe:/o:redhat:rhel_e4s:9.0::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:8.7p1-12.el9_0.3",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.2::appstream",
"cpe:/o:redhat:rhel_eus:9.2::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:8.7p1-30.el9_2.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.13::el8",
"cpe:/a:redhat:openshift:4.13::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.13",
"versions": [
{
"status": "unaffected",
"version": "413.92.202408122222-0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhcos",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.14::el8",
"cpe:/a:redhat:openshift:4.14::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.14",
"versions": [
{
"status": "unaffected",
"version": "414.92.202407300859-0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhcos",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.15::el8",
"cpe:/a:redhat:openshift:4.15::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"versions": [
{
"status": "unaffected",
"version": "415.92.202407301159-0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhcos",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"versions": [
{
"status": "unaffected",
"version": "416.94.202407171205-0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhcos",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "openssh",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
}
]
}
],
"published": "2024-07-08T18:15:09.487",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2024:4457",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4613",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4716",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4910",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4955",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4960",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:5444",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-6409",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295085",
"source": "secalert@redhat.com"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/08/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/09/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/09/5",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/10/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/10/2",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4457",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4613",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:4716",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-6409",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://almalinux.org/blog/2024-07-09-cve-2024-6409/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2295085",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1227217",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://explore.alas.aws.amazon.com/CVE-2024-6409.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/openela-main/openssh/commit/c00da7741d42029e49047dd89e266d91dcfbffa0",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2024-6409",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240712-0003/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://sig-security.rocky.page/issues/CVE-2024-6409/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://ubuntu.com/security/CVE-2024-6409",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.suse.com/security/cve/CVE-2024-6409.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-364"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server."
},
{
"lang": "es",
"value": "Se encontró una vulnerabilidad de condición de ejecución del controlador de señales en el servidor de OpenSSH (sshd), donde un cliente no se autentica dentro de los segundos de LoginGraceTime (120 de forma predeterminada, 600 en versiones anteriores de OpenSSH), luego se llama al controlador SIGALRM de sshd de forma asincrónica. Sin embargo, este controlador de señales llama a varias funciones que no son seguras para señales asíncronas, por ejemplo, syslog(). Este problema lo deja vulnerable a una condición de ejecución del controlador de señales en la función cleanup_exit(), que introduce la misma vulnerabilidad que CVE-2024-6387 en el hijo sin privilegios del servidor SSHD."
}
],
"lastModified": "2026-08-21T13:16:25.010",
"sourceIdentifier": "secalert@redhat.com"
}