CVE-2024-6387
There is a race condition which can lead sshd to handle some signals in an unsafe manner.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 99.5%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.51% probability · 100th percentile
- Public exploits
- 1 in Exploit-DB · first 22 April 2025
- CISA KEV
- Not listed
- Weakness
- CWE-364, CWE-362
- Affected
- sonicwall/sma 6200 firmware · sonicwall/sma 7200 firmware · arista/eos · canonical/ubuntu linux · almalinux/almalinux · sonicwall/sma 6210 firmware · sonicwall/sma 7210 firmware · sonicwall/sma 8200v firmware · sonicwall/sra ex 7000 firmware · netapp/a1k firmware · netapp/a70 firmware · netapp/a90 firmware · netapp/a700s firmware · netapp/8300 firmware · netapp/8700 firmware · netapp/a400 firmware · netapp/c400 firmware · netapp/a250 firmware · netapp/500f firmware · netapp/c250 firmware · +33 more
- Source
- secalert@redhat.com
EPSS 99.5% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (1)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
References
- https://access.redhat.com/errata/RHSA-2024:4312Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4340Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4389Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4469Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4474Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4479Third Party Advisory
- https://access.redhat.com/errata/RHSA-2024:4484Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-6387Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2294604Third Party Advisory
- https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlExploit, Third Party Advisory
- https://www.openssh.com/txt/release-9.8Release Notes, Third Party Advisory
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Jul/18Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/19Mailing List
- http://seclists.org/fulldisclosure/2024/Jul/20Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/01/12Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/01/13Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/02/1Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/03/1Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/03/11Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/03/2Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/03/3Mailing List, Patch
- http://www.openwall.com/lists/oss-security/2024/07/03/4Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/03/5Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/04/1Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/04/2Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/08/2Exploit, Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/08/3Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/09/2Mailing List
- http://www.openwall.com/lists/oss-security/2024/07/09/5Exploit, Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.