ZeroDay Findings
Sign inSign up

Findings

CVE-2024-6409

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd).

Published Jul 8, 2024 · updated Oct 15, 2026

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 8, 2024 · NIST NVD

    Detected

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario,

  2. Oct 15, 2026 · NIST NVD

    Updated

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario,

  3. Oct 15, 2026 · NIST NVD

    Updated

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario,

Sources

  • CVE.orgVulnerability recordCVE-2024-6409

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-6409

    30-day exploitation probability 27.9%

    first.org
  • NIST NVDVulnerability recordCVE-2024-6409

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions tha

    nvd.nist.gov

References