CVE-2024-6387

Published: Jul 1, 2024Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Affected (92)

Products: Sonicwall: Sma 6200 Firmware, Sma 7200 Firmware, Sma 6210 Firmware, Sma 7210 Firmware, Sma 8200v Firmware, Sra Ex 7000 Firmware · Arista: Eos · Canonical: Ubuntu Linux · +10 more

Show all products

Sonicwall: Sma 6200 Firmware, Sma 7200 Firmware, Sma 6210 Firmware, Sma 7210 Firmware, Sma 8200v Firmware, Sra Ex 7000 Firmware · Arista: Eos · Canonical: Ubuntu Linux · Almalinux: Almalinux · Netapp: A1k Firmware, A70 Firmware, A90 Firmware, A700s Firmware, 8300 Firmware, 8700 Firmware, A400 Firmware, C400 Firmware, A250 Firmware, 500f Firmware, C250 Firmware, A800 Firmware, C800 Firmware, A900 Firmware, A9500 Firmware, C190 Firmware, A150 Firmware, A220 Firmware, Fas2720 Firmware, Fas2750 Firmware, Fas2820 Firmware, Bootstrap Os, Active Iq Unified Manager, E Series Santricity Os Controller, Ontap, Ontap Select Deploy Administration Utility, Ontap Tools · Apple: Macos · Openbsd: Openssh · Redhat: Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Arm 64, Enterprise Linux For Arm 64 Eus, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Ibm Z Systems Eus, Enterprise Linux For Power Little Endian, Enterprise Linux For Power Little Endian Eus, Enterprise Linux Server Aus, Openshift Container Platform · Suse: Linux Enterprise Micro · Debian: Debian Linux · Amazon: Amazon Linux · Freebsd: Freebsd · Netbsd: Netbsd

6 products

1 product

1 product

1 product

27 products

Active Iq Unified Manager

E Series Santricity Os Controller

Ontap

Ontap Select Deploy Administration Utility

1 product

1 product

10 products

Enterprise Linux For Arm 64

Enterprise Linux For Arm 64 Eus

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Ibm Z Systems Eus

Enterprise Linux For Power Little Endian

Enterprise Linux For Power Little Endian Eus

Enterprise Linux Server Aus

Openshift Container Platform

Suse

1 product

Linux Enterprise Micro

1 product

1 product

1 product

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma 6200 Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sma 6200	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma 7200 Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sma 7200	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Arista Eos	From 4.32.0 to 4.32.1f

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 23.10
Canonical Ubuntu Linux	Version 24.04

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Almalinux Almalinux	Version 9.0

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma 6210 Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sma 6210	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma 7210 Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sma 7210	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sma 8200v Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sma 8200v	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Sonicwall Sra Ex 7000 Firmware	All versions

Running on/with	Platform Versions
Sonicwall Sra Ex 7000	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A1k Firmware	All versions

Running on/with	Platform Versions
Netapp A1k	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A70 Firmware	All versions

Running on/with	Platform Versions
Netapp A70	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A90 Firmware	All versions

Running on/with	Platform Versions
Netapp A90	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A700s Firmware	All versions

Running on/with	Platform Versions
Netapp A700s	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp 8300 Firmware	All versions

Running on/with	Platform Versions
Netapp 8300	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp 8700 Firmware	All versions

Running on/with	Platform Versions
Netapp 8700	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A400 Firmware	All versions

Running on/with	Platform Versions
Netapp A400	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C400 Firmware	All versions

Running on/with	Platform Versions
Netapp C400	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A250 Firmware	All versions

Running on/with	Platform Versions
Netapp A250	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp 500f Firmware	All versions

Running on/with	Platform Versions
Netapp 500f	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C250 Firmware	All versions

Running on/with	Platform Versions
Netapp C250	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A800 Firmware	All versions

Running on/with	Platform Versions
Netapp A800	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C800 Firmware	All versions

Running on/with	Platform Versions
Netapp C800	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A900 Firmware	All versions

Running on/with	Platform Versions
Netapp A900	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A9500 Firmware	All versions

Running on/with	Platform Versions
Netapp A9500	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp C190 Firmware	All versions

Running on/with	Platform Versions
Netapp C190	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A150 Firmware	All versions

Running on/with	Platform Versions
Netapp A150	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp A220 Firmware	All versions

Running on/with	Platform Versions
Netapp A220	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2720 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2720	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2750 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2750	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Fas2820 Firmware	All versions

Running on/with	Platform Versions
Netapp Fas2820	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Bootstrap Os	All versions

Running on/with	Platform Versions
Netapp Hci Compute Node	All versions

Configuration F

3 vulnerable

Vulnerable Software	Affected Versions
Apple Macos	From 12.0 to 12.7.6
Apple Macos	From 13.0 to 13.6.8
Apple Macos	From 14.0 to 14.6

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
Openbsd Openssh	Before 4.4
Openbsd Openssh	From 8.6 to 9.8
Openbsd Openssh	Version 4.4
Openbsd Openssh	Version 8.5 p1
Openbsd Openssh	Version 8.6

Configuration H

10 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 9.0
Redhat Enterprise Linux Eus	Version 9.4
Redhat Enterprise Linux For Arm 64	Version 9.0_aarch64
Redhat Enterprise Linux For Arm 64 Eus	Version 9.4_aarch64
Redhat Enterprise Linux For Ibm Z Systems	Version 9.0_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus	Version 9.4_s390x
Redhat Enterprise Linux For Power Little Endian	Version 9.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus	Version 9.4_ppc64le
Redhat Enterprise Linux Server Aus	Version 9.4
Redhat Openshift Container Platform	Version 4.0

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Micro	Version 6.0

Configuration J

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 12.0

Configuration K

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 22.04
Canonical Ubuntu Linux	Version 22.10
Canonical Ubuntu Linux	Version 23.04

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Amazon Amazon Linux	Version 2023.0

Configuration M

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp E Series Santricity Os Controller	From 11.0.0 to 11.70.2
Netapp Ontap	Version 9
Netapp Ontap Select Deploy Administration Utility	All versions
Netapp Ontap Tools	Version 10
Netapp Ontap Tools	Version 9

Configuration N

29 vulnerable

Vulnerable Software	Affected Versions
Freebsd Freebsd	Version 13.2
Freebsd Freebsd	Version 13.2 p10
Freebsd Freebsd	Version 13.2 p11
Freebsd Freebsd	Version 13.2 p1
Freebsd Freebsd	Version 13.2 p2
Freebsd Freebsd	Version 13.2 p3
Freebsd Freebsd	Version 13.2 p4
Freebsd Freebsd	Version 13.2 p5
Freebsd Freebsd	Version 13.2 p6
Freebsd Freebsd	Version 13.2 p7
Freebsd Freebsd	Version 13.2 p8
Freebsd Freebsd	Version 13.2 p9
Freebsd Freebsd	Version 13.3
Freebsd Freebsd	Version 13.3 p1
Freebsd Freebsd	Version 13.3 p2
Freebsd Freebsd	Version 13.3 p3
Freebsd Freebsd	Version 14.0
Freebsd Freebsd	Version 14.0 beta5
Freebsd Freebsd	Version 14.0 p1
Freebsd Freebsd	Version 14.0 p2
Freebsd Freebsd	Version 14.0 p3
Freebsd Freebsd	Version 14.0 p4
Freebsd Freebsd	Version 14.0 p5
Freebsd Freebsd	Version 14.0 p6
Freebsd Freebsd	Version 14.0 p7
Freebsd Freebsd	Version 14.0 rc3
Freebsd Freebsd	Version 14.0 rc4-p1
Freebsd Freebsd	Version 14.1
Freebsd Freebsd	Version 14.1 p1

Configuration O

1 vulnerable

Vulnerable Software	Affected Versions
Netbsd Netbsd	Up to 10.0.0

Related CWEs

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

CWE-364

Signal Handler Race Condition

The product uses a signal handler that introduces a race condition.

References (93)

https://access.redhat.com/errata/RHSA-2024:4312

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4340

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4389

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4469

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4474

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4479

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4484

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/security/cve/CVE-2024-6387

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2294604

Source: secalert@redhat.com

Third Party Advisory

https://santandersecurityresearch.github.io/blog/sshing_the_masses.html

Source: secalert@redhat.com

ExploitThird Party Advisory

https://www.openssh.com/txt/release-9.8

Source: secalert@redhat.com

Release NotesThird Party Advisory

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt

Source: secalert@redhat.com

ExploitThird Party Advisory

http://seclists.org/fulldisclosure/2024/Jul/18