Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9
Priority MEDIUM 55CWE-364Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.27935 98th percentileScored 2026-11-07
Fix Fixed Red Hat: 7 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | OpenSSH | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 8.7p1-38.el9_4.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 8.7p1-38.el9_4.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | 8.7p1-12.el9_0.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 8.7p1-30.el9_2.7 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 413.92.202408122222-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 414.92.202407300859-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 415.92.202407301159-0 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 416.94.202407171205-0 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
- OpenSSH Vendor— Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 8.7p1-38.el9_4.4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 8.7p1-38.el9_4.4 Patch available CNA
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8.7p1-12.el9_0.3 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 8.7p1-30.el9_2.7 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 413.92.202408122222-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 414.92.202407300859-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 415.92.202407301159-0 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 416.94.202407171205-0 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE names CNA · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:enterprise_linux:9::appstream | 9 | — | Red Hat |
| cpe:/o:redhat:enterprise_linux:9::baseos | 9 | — | Red Hat |
| cpe:/a:redhat:rhel_e4s:9.0::appstream | 9.0 | — | Red Hat |
| cpe:/o:redhat:rhel_e4s:9.0::baseos | 9.0 | — | Red Hat |
| cpe:/a:redhat:rhel_eus:9.2::appstream | 9.2 | — | Red Hat |
| cpe:/o:redhat:rhel_eus:9.2::baseos | 9.2 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el8 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.13::el9 | 4.13 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el8 | 4.14 | — | Red Hat |
| cpe:/a:redhat:openshift:4.14::el9 | 4.14 | — | Red Hat |
- cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
- cpe:/o:redhat:enterprise_linux:9::baseos Versions 9 — ·Red Hat
- cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
- cpe:/o:redhat:rhel_e4s:9.0::baseos Versions 9.0 — ·Red Hat
- cpe:/a:redhat:rhel_eus:9.2::appstream Versions 9.2 — ·Red Hat
- cpe:/o:redhat:rhel_eus:9.2::baseos Versions 9.2 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el8 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.13::el9 Versions 4.13 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el8 Versions 4.14 — ·Red Hat
- cpe:/a:redhat:openshift:4.14::el9 Versions 4.14 — ·Red Hat
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:openshift:4.15::el8 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.15::el9 | 4.15 | — | Red Hat |
| cpe:/a:redhat:openshift:4.16::el9 | 4.16 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:10 | 10 | — | Red Hat |
| cpe:/o:redhat:rhel_els:6 | 6 | — | Red Hat |
| cpe:/o:redhat:rhel_els:7 | 7 | — | Red Hat |
| cpe:/a:redhat:enterprise_linux:8 | 8 | — | Red Hat |
- cpe:/a:redhat:openshift:4.15::el8 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.15::el9 Versions 4.15 — ·Red Hat
- cpe:/a:redhat:openshift:4.16::el9 Versions 4.16 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:10 Versions 10 — ·Red Hat
- cpe:/o:redhat:rhel_els:6 Versions 6 — ·Red Hat
- cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:enterprise_linux:8 Versions 8 — ·Red Hat
Remediation
Red Hat 7 advisories
- RHSA-2024:5444 Released 2024-08-22 · Red Hat rating ImportantOpenShift Container Platform 4.13.48 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2024:4960 Released 2024-08-07 · Red Hat rating ImportantOpenShift Container Platform 4.14.34 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-ebs-csi-driver-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8 +6
- RHSA-2024:4955 Released 2024-08-07 · Red Hat rating ModerateOpenShift Container Platform 4.15.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/egress-router-cni-rhel8, rhcos
Show 4 more Red Hat advisories
- RHSA-2024:4910 Released 2024-07-30 · Red Hat rating Moderateopenssh security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) openssh-askpass-8.7p1-12.el9_0.3, pam_ssh_agent_auth-0.10.4-4.12.el9_0.3
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) openssh-8.7p1-12.el9_0.3, openssh-clients-8.7p1-12.el9_0.3, openssh-keycat-8.7p1-12.el9_0.3 +1
- RHSA-2024:4613 Released 2024-07-24 · Red Hat rating ModerateOpenShift Container Platform 4.16.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/egress-router-cni-rhel9, openshift4/network-tools-rhel9, openshift4/ose-agent-installer-api-server-rhel9 +35
- RHSA-2024:4716 Released 2024-07-23 · Red Hat rating Moderateopenssh security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) openssh-askpass-8.7p1-30.el9_2.7, pam_ssh_agent_auth-0.10.4-5.30.el9_2.7
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) openssh-8.7p1-30.el9_2.7, openssh-clients-8.7p1-30.el9_2.7, openssh-keycat-8.7p1-30.el9_2.7 +1
- RHSA-2024:4457 Released 2024-07-10 · Red Hat rating Moderateopenssh security update
- Red Hat Enterprise Linux AppStream (v. 9) openssh-askpass-8.7p1-38.el9_4.4, pam_ssh_agent_auth-0.10.4-5.38.el9_4.4
- Red Hat Enterprise Linux BaseOS (v. 9) openssh-8.7p1-38.el9_4.4, openssh-clients-8.7p1-38.el9_4.4, openssh-keycat-8.7p1-38.el9_4.4 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:4457 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:4910 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:4716 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:4457 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2024:4910 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2024:4716 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:5444 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2024:4960 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2024:4955 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:4613 |
Not affected: 8 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6409
- 2026-10-03 Alias added: GHSA-79hg-h6r6-64mm
- 2026-10-15 Fix available: openshift/[email protected], openshift/[email protected], openshift/[email protected] +1 · CNA
- 2026-11-03 CISA SSVC decision points changed
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-6409 · CVE Program
- CVE-2024-6409 · NVD
- FIRST EPSS
- GHSA-79hg-h6r6-64mm · GitHub Advisory Database · CC BY 4.0
- CVE-2024-6409 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences