CVE-2024-6387
Public on 2024-07-01
Modified on 2024-07-04
Description
A signal handler race condition was found in the OpenSSH server (sshd). If a client does not authenticate within the LoginGraceTime period (120 seconds by default, or 600 seconds in older OpenSSH versions), the sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, such as syslog().
AL1 and AL2 comes with OpenSSH version 7.4p1. OpenSSH versions from 4.4p1 up to, but not including, 8.5p1 are not impacted by CVE-2024-6387.
AL1 and AL2 comes with OpenSSH version 7.4p1. OpenSSH versions from 4.4p1 up to, but not including, 8.5p1 are not impacted by CVE-2024-6387.
Severity
Important
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | openssh | Not Affected | ||
| Amazon Linux 2 - Core | openssh | Not Affected | ||
| Amazon Linux 2023 | openssh | 2024-06-26 | ALAS2023-2024-649 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | CVSSv3 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |