# CVE-2024-6387: Openssh: regresshion - race condition in ssh allows rce/dos

Status: published. Published: 2024-07-01. Updated: 2026-11-06.

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

## Remediation

- workaround: The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections.

1) As root user, open the /etc/ssh/sshd_config
2) Add or edit the parameter configuration:
~~~
LoginGraceTime 0
~~~
3) Save and close the file
4) Restart the sshd daemon:
~~~
systemctl restart sshd.service
~~~

Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately.

If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed. (source: CNA: redhat)

## Affected products and versions

-  /  (OpenSSH): ≥ 8.5p1; ≤ 9.7p1 (affected, custom). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (openssh): ≥ 0:8.7p1-38.el9_4.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (openssh): ≥ 0:8.7p1-12.el9_0.1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9.2 Extended Update Support (openssh): ≥ 0:8.7p1-30.el9_2.4; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.13 (openshift/ose-rhel-coreos-9): ≥ 413.92.202407091321-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.14 (openshift/ose-rhel-coreos-9): ≥ 414.92.202407091253-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.15 (openshift/ose-rhel-coreos-9): ≥ 415.92.202407091355-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4.16 (openshift/ose-rhel-coreos-9): ≥ 416.94.202407081958-0; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Ceph Storage 5 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Ceph Storage 6 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Ceph Storage 7 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 10 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (openssh): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Siemens / Industrial Edge Management OS (IEM-OS): ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SINAMICS IIoT module: ≥ 0; < V1.0 HF1 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SINEMA Remote Connect Server: ≥ 0; < V3.2 SP2 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SINUMERIK ONE: ≥ 0; < V6.24 (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP: ≥ V3.1.5; < * (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: redhat

- CISA KEV: No listing in collected sources

- EPSS: 99.51% as of 2026-11-06; percentile 99.94%

- SSVC: exploitation poc; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-364

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2024:4312 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4340 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4389 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4469 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4474 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4479 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2024:4484 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2024-6387 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2294604 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html (CNA: redhat)

- https://www.openssh.com/txt/release-9.8 (CNA: redhat)

- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt (CNA: redhat)

- https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387 (ADP: CVE)

- https://www.exploit-db.com/exploits/52269 (ADP: CVE)

- https://packetstorm.news/files/id/190587/ (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2024/07/01/12 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/01/13 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/02/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/11 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/4 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/03/5 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/04/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/04/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/08/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/08/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/09/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/09/5 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/10/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/10/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/10/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/10/4 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/10/6 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/11/1 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/11/3 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/23/4 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/23/6 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/28/2 (ADP: CVE; x_transferred)

- http://www.openwall.com/lists/oss-security/2024/07/28/3 (ADP: CVE; x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4312 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4340 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4389 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4469 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4474 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4479 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/errata/RHSA-2024:4484 (ADP: CVE; vendor-advisory, x_refsource_REDHAT, x_transferred)

- https://access.redhat.com/security/cve/CVE-2024-6387 (ADP: CVE; vdb-entry, x_refsource_REDHAT, x_transferred)

- https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/ (ADP: CVE; x_transferred)

- https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/ (ADP: CVE; x_transferred)

- https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server (ADP: CVE; x_transferred)

- https://bugzilla.redhat.com/show_bug.cgi?id=2294604 (ADP: CVE; issue-tracking, x_refsource_REDHAT, x_transferred)

- https://explore.alas.aws.amazon.com/CVE-2024-6387.html (ADP: CVE; x_transferred)

- https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132 (ADP: CVE; x_transferred)

- https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc (ADP: CVE; x_transferred)

- https://github.com/AlmaLinux/updates/issues/629 (ADP: CVE; x_transferred)

- https://github.com/Azure/AKS/issues/4379 (ADP: CVE; x_transferred)

- https://github.com/PowerShell/Win32-OpenSSH/discussions/2248 (ADP: CVE; x_transferred)

- https://github.com/PowerShell/Win32-OpenSSH/issues/2249 (ADP: CVE; x_transferred)

- https://github.com/microsoft/azurelinux/issues/9555 (ADP: CVE; x_transferred)

- https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09 (ADP: CVE; x_transferred)

- https://github.com/oracle/oracle-linux/issues/149 (ADP: CVE; x_transferred)

- https://github.com/rapier1/hpn-ssh/issues/87 (ADP: CVE; x_transferred)

- https://github.com/zgzhang/cve-2024-6387-poc (ADP: CVE; x_transferred)

- https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/ (ADP: CVE; x_transferred)

- https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html (ADP: CVE; x_transferred)

- https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html (ADP: CVE; x_transferred)

- https://news.ycombinator.com/item?id=40843778 (ADP: CVE; x_transferred)

- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010 (ADP: CVE; x_transferred)

- https://santandersecurityresearch.github.io/blog/sshing_the_masses.html (ADP: CVE; x_transferred)

- https://security-tracker.debian.org/tracker/CVE-2024-6387 (ADP: CVE; x_transferred)

- https://security.netapp.com/advisory/ntap-20240701-0001/ (ADP: CVE; x_transferred)

- https://sig-security.rocky.page/issues/CVE-2024-6387/ (ADP: CVE; x_transferred)

- https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/ (ADP: CVE; x_transferred)

- https://ubuntu.com/security/CVE-2024-6387 (ADP: CVE; x_transferred)

- https://ubuntu.com/security/notices/USN-6859-1 (ADP: CVE; x_transferred)

- https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do (ADP: CVE; x_transferred)

- https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100 (ADP: CVE; x_transferred)

- https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc (ADP: CVE; x_transferred)

- https://www.openssh.com/txt/release-9.8 (ADP: CVE; x_transferred)

- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt (ADP: CVE; x_transferred)

- https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html (ADP: CVE; x_transferred)

- https://www.suse.com/security/cve/CVE-2024-6387.html (ADP: CVE; x_transferred)

- https://www.theregister.com/2024/07/01/regresshion_openssh/ (ADP: CVE; x_transferred)

- https://support.apple.com/kb/HT214119 (ADP: CVE; x_transferred)

- https://support.apple.com/kb/HT214118 (ADP: CVE; x_transferred)

- https://support.apple.com/kb/HT214120 (ADP: CVE; x_transferred)

- http://seclists.org/fulldisclosure/2024/Jul/20 (ADP: CVE; x_transferred)

- http://seclists.org/fulldisclosure/2024/Jul/18 (ADP: CVE; x_transferred)

- http://seclists.org/fulldisclosure/2024/Jul/19 (ADP: CVE; x_transferred)

- https://cert-portal.siemens.com/productcert/html/ssa-446545.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-082556.html (ADP: siemens-SADP)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2024-6387; retrieved 2026-11-06; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2024-6387; retrieved 2026-11-06; source updated Not reported

Revision: 9642204e584094dc2b8d50965beef354ecd162f7c8732ede1a95d866ef2d1060

Canonical: https://y2.dev/cve/CVE-2024-6387

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.