A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
References
Configurations
No configuration.
History
15 Oct 2026, 01:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2024-07-08 18:15
Updated : 2026-10-15 03:17
NVD link : CVE-2024-6409
Mitre link : CVE-2024-6409
CVE.ORG link : CVE-2024-6409
JSON object : View
Products Affected
No product.
CWE
CWE-364
Signal Handler Race Condition