Vulnerability report

CVE-2024-6387

Red Hat Enterprise Linux 9 Remote Code Execution

Red Hat / Red Hat Enterprise Linux 9 · affected before *

View live feed Monitor via API Watch CVE-2024-6387
Severity
CVSS 8.1 · High
Confidence
—
Exploit status
—
EPSS
—
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2024-6387 is an unauthenticated vulnerability affecting Red Hat Red Hat Enterprise Linux 9 and 14 other products. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race...

Is it exploited?

No. Previdian has not recorded active exploitation signals yet.

Who is affected?

Red Hat / Red Hat Enterprise Linux 9 affected before *.

What should we do?

Track for updates. Assess relevance to your asset inventory and enrichment workflows.

Overview

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner.

An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Vendor Product Affected Status
Siemens Industrial Edge Management OS (IEM-OS) Before * Affected
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Before * Affected
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Before * Affected
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Before * Affected
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Before * Affected
Siemens SINAMICS IIoT module Before V1.0 HF1 Affected
Siemens SINEMA Remote Connect Server Before V3.2 SP2 Affected
Siemens SINUMERIK ONE Before V6.24 Affected
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Before * Affected
— — OpenSSH Through 9.7p1 Affected
Red Hat Red Hat Enterprise Linux 9 openssh Before * Unaffected
Red Hat Red Hat Enterprise Linux 9 openssh Before * Unaffected
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions openssh Before * Unaffected
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support openssh Before * Unaffected
Red Hat Red Hat OpenShift Container Platform 4.13 rhcos Before * Unaffected
Red Hat Red Hat OpenShift Container Platform 4.14 rhcos Before * Unaffected
Red Hat Red Hat OpenShift Container Platform 4.15 rhcos Before * Unaffected
Red Hat Red Hat OpenShift Container Platform 4.16 rhcos Before * Unaffected
Red Hat Red Hat Ceph Storage 5 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Ceph Storage 6 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Ceph Storage 7 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Enterprise Linux 10 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Enterprise Linux 6 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Enterprise Linux 7 openssh All versions (default: unaffected) Unaffected
Red Hat Red Hat Enterprise Linux 8 openssh All versions (default: unaffected) Unaffected
View vendor advisory (opens in new tab)
Published
01 Jul 2024
Exploited since
—
Attack vector
Remote
Complexity
High
Privileges
None
User interaction
None

CVE References

Exploitation evidence

Exploitation evidence for this CVE

Catalogues and sources that list this CVE as a known exploited vulnerability, when available.

No exploitation evidence rows are recorded for this CVE yet.

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts
0
0
0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Scanner Artifacts

Scanner and exploit-framework references linked to this CVE.

Scanner Reference Detected
Nessus https://www.tenable.com/plugins/nessus/206464 03 Sep 2024

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

—

Weaknesses

Signal Handler Race Condition CWE-364

Timeline

From disclosure to observed exploitation

  1. Nessus plugin available

    Scanner coverage available

  2. CVE published

    Vulnerability disclosed publicly

  3. CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro pricing Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2024-6387

Free JSON includes basic KEV fields 
{
  "cve_id": "CVE-2024-6387",
  "confidence": null,
  "cvss_score": 8.1,
  "cvss_estimated": false,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": false,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}