CVE-2024-6387

HIGHScheduled

Published:Jul 1, 2024(1 year ago)

Modified:Sep 30, 2025

Remote ExploitNo Auth RequiredNo Interaction

Vulnerability Description

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Attack Characteristics

Network AccessHigh ComplexityNo Auth NeededNo User Interaction

🤖

AI analysis not yet available

Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.

No Fix Known

No patch has been released yet. Apply workarounds or mitigations where available.

Affected Software

Vendor	Product	Versions	Fixed In
sonicwall	sma_6200_firmware	-	-
sonicwall	sma_7200_firmware	-	-
arista	eos	4.32.0 - 4.32.1f

Timeline

Published
CVE disclosed publicly
Jul 1, 20241 year ago
Last Modified
Most recent update
Sep 30, 20257 months ago
Indexed to CVEInsight
Added to this platform
Mar 29, 20261 month ago

References

https://access.redhat.com/errata/RHSA-2024:4312Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389Third Party Advisory

CVSS Score

v3.1

8.1/ 10.0

HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

At a Glance

Affected Products

References

sonicwall / sma_6200_firmware

https://access.redhat.com/errata/RHSA-2024:4469Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4474Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4479Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4484Third Party Advisory

https://access.redhat.com/security/cve/CVE-2024-6387Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2294604Third Party Advisory

https://santandersecurityresearch.github.io/blog/sshing_the_masses.htm...Exploit

https://www.openssh.com/txt/release-9.8Release Notes

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtExploit

http://seclists.org/fulldisclosure/2024/Jul/18Mailing List

http://seclists.org/fulldisclosure/2024/Jul/19Mailing List

http://seclists.org/fulldisclosure/2024/Jul/20Mailing List

http://www.openwall.com/lists/oss-security/2024/07/01/12Mailing List

http://www.openwall.com/lists/oss-security/2024/07/01/13Mailing List

http://www.openwall.com/lists/oss-security/2024/07/02/1Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/1Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/11Exploit

http://www.openwall.com/lists/oss-security/2024/07/03/2Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/3Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/4Mailing List

http://www.openwall.com/lists/oss-security/2024/07/03/5Mailing List

http://www.openwall.com/lists/oss-security/2024/07/04/1Mailing List

http://www.openwall.com/lists/oss-security/2024/07/04/2Exploit

http://www.openwall.com/lists/oss-security/2024/07/08/2Exploit

http://www.openwall.com/lists/oss-security/2024/07/08/3Mailing List

http://www.openwall.com/lists/oss-security/2024/07/09/2Mailing List

http://www.openwall.com/lists/oss-security/2024/07/09/5Exploit

http://www.openwall.com/lists/oss-security/2024/07/10/1Exploit

http://www.openwall.com/lists/oss-security/2024/07/10/2Mailing List

http://www.openwall.com/lists/oss-security/2024/07/10/3Mailing List

http://www.openwall.com/lists/oss-security/2024/07/10/4Mailing List

http://www.openwall.com/lists/oss-security/2024/07/10/6Mailing List

http://www.openwall.com/lists/oss-security/2024/07/11/1Mailing List

http://www.openwall.com/lists/oss-security/2024/07/11/3Mailing List

http://www.openwall.com/lists/oss-security/2024/07/23/4Mailing List

http://www.openwall.com/lists/oss-security/2024/07/23/6Mailing List

http://www.openwall.com/lists/oss-security/2024/07/28/2Mailing List

http://www.openwall.com/lists/oss-security/2024/07/28/3Mailing List

https://access.redhat.com/errata/RHSA-2024:4312Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4340Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4389Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4469Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4474Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4479Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:4484Third Party Advisory

https://access.redhat.com/security/cve/CVE-2024-6387Third Party Advisory

https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-afte...Third Party Advisory

https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-...Press/Media Coverage

https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/reg...Press/Media Coverage

https://bugzilla.redhat.com/show_bug.cgi?id=2294604Third Party Advisory

https://explore.alas.aws.amazon.com/CVE-2024-6387.htmlThird Party Advisory

https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132Issue Tracking

https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-00...Release Notes

https://github.com/AlmaLinux/updates/issues/629Issue Tracking

https://github.com/Azure/AKS/issues/4379Issue Tracking

https://github.com/PowerShell/Win32-OpenSSH/discussions/2248Issue Tracking

https://github.com/PowerShell/Win32-OpenSSH/issues/2249Issue Tracking

https://github.com/microsoft/azurelinux/issues/9555Issue Tracking

https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a6...Patch

https://github.com/oracle/oracle-linux/issues/149Issue Tracking

https://github.com/rapier1/hpn-ssh/issues/87Issue Tracking

https://github.com/zgzhang/cve-2024-6387-pocThird Party Advisory

https://lists.almalinux.org/archives/list/announce@lists.almalinux.org...Third Party Advisory

https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/00...Mailing List

https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431....Mailing List

https://news.ycombinator.com/item?id=40843778Issue Tracking

https://packetstorm.news/files/id/190587/Broken Link

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010Third Party Advisory

https://santandersecurityresearch.github.io/blog/sshing_the_masses.htm...Exploit

https://security-tracker.debian.org/tracker/CVE-2024-6387Third Party Advisory

https://security.netapp.com/advisory/ntap-20240701-0001/Third Party Advisory

https://sig-security.rocky.page/issues/CVE-2024-6387/Third Party Advisory

https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-co...Press/Media Coverage

https://support.apple.com/kb/HT214118Third Party Advisory

https://support.apple.com/kb/HT214119Third Party Advisory

https://support.apple.com/kb/HT214120Third Party Advisory

https://ubuntu.com/security/CVE-2024-6387Third Party Advisory

https://ubuntu.com/security/notices/USN-6859-1Third Party Advisory

https://www.akamai.com/blog/security-research/2024-openssh-vulnerabili...Third Party Advisory

https://www.arista.com/en/support/advisories-notices/security-advisory...Third Party Advisory

https://www.exploit-db.com/exploits/52269Exploit

https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.a...Third Party Advisory

https://www.openssh.com/txt/release-9.8Release Notes

https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtExploit

https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-v...Third Party Advisory

https://www.suse.com/security/cve/CVE-2024-6387.htmlThird Party Advisory

https://www.theregister.com/2024/07/01/regresshion_openssh/Press/Media Coverage

https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regressi...Exploit

CVSS v3 Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges RequiredNone

User InteractionNone

Impact

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

Impact Analysis

ConfidentialityHigh

NoneLowHigh

IntegrityHigh

NoneLowHigh

AvailabilityHigh

NoneLowHigh

CVE-2024-6387

✦ Vulnerability Description

Attack Characteristics

Affected Software

Timeline

References

CVSS Score

At a Glance

Official Sources

CVSS v3 Vector

Impact Analysis

Vulnerability Description