Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-6387

Summary
Assigner-redhat
Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749
Published At-01 Jul, 2024 | 12:37
Updated At-24 Jul, 2025 | 13:11
Rejected At-
Credits

Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:redhat
Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749
Published At:01 Jul, 2024 | 12:37
Updated At:24 Jul, 2025 | 13:11
Rejected At:
▼CVE Numbering Authority (CNA)
Openssh: regresshion - race condition in ssh allows rce/dos

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Affected Products
Collection URL
https://www.openssh.com/
Package Name
OpenSSH
Repo
https://anongit.mindrot.org/openssh.git
Default Status
unaffected
Versions
Affected
  • From 8.5p1 through 9.7p1 (custom)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:9::baseos
  • cpe:/a:redhat:enterprise_linux:9::appstream
Default Status
affected
Versions
Unaffected
  • From 0:8.7p1-38.el9_4.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:9::baseos
  • cpe:/a:redhat:enterprise_linux:9::appstream
Default Status
affected
Versions
Unaffected
  • From 0:8.7p1-38.el9_4.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/a:redhat:rhel_e4s:9.0::appstream
  • cpe:/o:redhat:rhel_e4s:9.0::baseos
Default Status
affected
Versions
Unaffected
  • From 0:8.7p1-12.el9_0.1 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9.2 Extended Update Support
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:rhel_eus:9.2::baseos
  • cpe:/a:redhat:rhel_eus:9.2::appstream
Default Status
affected
Versions
Unaffected
  • From 0:8.7p1-30.el9_2.4 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Container Platform 4.13
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhcos
CPEs
  • cpe:/a:redhat:openshift:4.13::el8
  • cpe:/a:redhat:openshift:4.13::el9
Default Status
affected
Versions
Unaffected
  • From 413.92.202407091321-0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Container Platform 4.14
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhcos
CPEs
  • cpe:/a:redhat:openshift:4.14::el9
  • cpe:/a:redhat:openshift:4.14::el8
Default Status
affected
Versions
Unaffected
  • From 414.92.202407091253-0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Container Platform 4.15
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhcos
CPEs
  • cpe:/a:redhat:openshift:4.15::el9
  • cpe:/a:redhat:openshift:4.15::el8
Default Status
affected
Versions
Unaffected
  • From 415.92.202407091355-0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat OpenShift Container Platform 4.16
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhcos
CPEs
  • cpe:/a:redhat:openshift:4.16::el9
Default Status
affected
Versions
Unaffected
  • From 416.94.202407081958-0 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ceph Storage 5
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/a:redhat:ceph_storage:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ceph Storage 6
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/a:redhat:ceph_storage:6
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Ceph Storage 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/a:redhat:ceph_storage:7
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:10
Default Status
affected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 6
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:6
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:7
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openssh
CPEs
  • cpe:/o:redhat:enterprise_linux:8
Default Status
unaffected
Problem Types
TypeCWE IDDescription
CWECWE-364Signal Handler Race Condition
Type: CWE
CWE ID: CWE-364
Description: Signal Handler Race Condition
Metrics
VersionBase scoreBase severityVector
3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

The below process can protect against a Remote Code Execution attack by disabling the LoginGraceTime parameter on Red Hat Enterprise Linux 9. However, the sshd server is still vulnerable to a Denial of Service if an attacker exhausts all the connections. 1) As root user, open the /etc/ssh/sshd_config 2) Add or edit the parameter configuration: ~~~ LoginGraceTime 0 ~~~ 3) Save and close the file 4) Restart the sshd daemon: ~~~ systemctl restart sshd.service ~~~ Setting LoginGraceTime to 0 disables the SSHD server's ability to drop connections if authentication is not completed within the specified timeout. If this mitigation is implemented, it is highly recommended to use a tool like 'fail2ban' alongside a firewall to monitor log files and manage connections appropriately. If any of the mitigations mentioned above is used, please note that the removal of LoginGraceTime parameter from sshd_config is not automatic when the updated package is installed.

Exploits

Credits

Red Hat would like to thank Qualys Threat Research Unit (TRU) (Qualys) for reporting this issue.
Timeline
EventDate
Reported to Red Hat.2024-06-27 00:00:00
Made public.2024-07-01 08:00:00
Event: Reported to Red Hat.
Date: 2024-06-27 00:00:00
Event: Made public.
Date: 2024-07-01 08:00:00
Replaced By

Rejected Reason

References
HyperlinkResource
https://access.redhat.com/errata/RHSA-2024:4312
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4340
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4389
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4469
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4474
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4479
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:4484
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-6387
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2294604
issue-tracking
x_refsource_REDHAT
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
N/A
https://www.openssh.com/txt/release-9.8
N/A
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
N/A
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4312
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4340
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4389
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4469
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4474
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4479
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4484
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2024-6387
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2294604
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
Resource: N/A
Hyperlink: https://www.openssh.com/txt/release-9.8
Resource: N/A
Hyperlink: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Resource: N/A
▼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
N/A
https://www.exploit-db.com/exploits/52269
N/A
https://packetstorm.news/files/id/190587/
N/A
http://www.openwall.com/lists/oss-security/2024/07/01/12
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/01/13
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/02/1
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/1
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/11
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/3
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/4
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/03/5
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/04/1
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/04/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/08/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/08/3
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/09/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/09/5
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/10/1
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/10/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/10/3
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/10/4
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/10/6
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/11/1
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/11/3
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/23/4
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/23/6
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/28/2
x_transferred
http://www.openwall.com/lists/oss-security/2024/07/28/3
x_transferred
https://access.redhat.com/errata/RHSA-2024:4312
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4340
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4389
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4469
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4474
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4479
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/errata/RHSA-2024:4484
vendor-advisory
x_refsource_REDHAT
x_transferred
https://access.redhat.com/security/cve/CVE-2024-6387
vdb-entry
x_refsource_REDHAT
x_transferred
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
x_transferred
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
x_transferred
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=2294604
issue-tracking
x_refsource_REDHAT
x_transferred
https://explore.alas.aws.amazon.com/CVE-2024-6387.html
x_transferred
https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132
x_transferred
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc
x_transferred
https://github.com/AlmaLinux/updates/issues/629
x_transferred
https://github.com/Azure/AKS/issues/4379
x_transferred
https://github.com/PowerShell/Win32-OpenSSH/discussions/2248
x_transferred
https://github.com/PowerShell/Win32-OpenSSH/issues/2249
x_transferred
https://github.com/microsoft/azurelinux/issues/9555
x_transferred
https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09
x_transferred
https://github.com/oracle/oracle-linux/issues/149
x_transferred
https://github.com/rapier1/hpn-ssh/issues/87
x_transferred
https://github.com/zgzhang/cve-2024-6387-poc
x_transferred
https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/
x_transferred
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
x_transferred
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
x_transferred
https://news.ycombinator.com/item?id=40843778
x_transferred
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
x_transferred
https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
x_transferred
https://security-tracker.debian.org/tracker/CVE-2024-6387
x_transferred
https://security.netapp.com/advisory/ntap-20240701-0001/
x_transferred
https://sig-security.rocky.page/issues/CVE-2024-6387/
x_transferred
https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
x_transferred
https://ubuntu.com/security/CVE-2024-6387
x_transferred
https://ubuntu.com/security/notices/USN-6859-1
x_transferred
https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do
x_transferred
https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100
x_transferred
https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc
x_transferred
https://www.openssh.com/txt/release-9.8
x_transferred
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
x_transferred
https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html
x_transferred
https://www.suse.com/security/cve/CVE-2024-6387.html
x_transferred
https://www.theregister.com/2024/07/01/regresshion_openssh/
x_transferred
https://support.apple.com/kb/HT214119
x_transferred
https://support.apple.com/kb/HT214118
x_transferred
https://support.apple.com/kb/HT214120
x_transferred
http://seclists.org/fulldisclosure/2024/Jul/20
x_transferred
http://seclists.org/fulldisclosure/2024/Jul/18
x_transferred
http://seclists.org/fulldisclosure/2024/Jul/19
x_transferred
Hyperlink: https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
Resource: N/A
Hyperlink: https://www.exploit-db.com/exploits/52269
Resource: N/A
Hyperlink: https://packetstorm.news/files/id/190587/
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/01/12
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/01/13
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/02/1
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/1
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/11
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/3
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/4
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/5
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/04/1
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/04/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/08/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/08/3
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/09/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/09/5
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/1
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/3
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/4
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/6
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/11/1
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/11/3
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/23/4
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/23/6
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/28/2
Resource:
x_transferred
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/28/3
Resource:
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4312
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4340
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4389
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4469
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4474
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4479
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4484
Resource:
vendor-advisory
x_refsource_REDHAT
x_transferred
Hyperlink: https://access.redhat.com/security/cve/CVE-2024-6387
Resource:
vdb-entry
x_refsource_REDHAT
x_transferred
Hyperlink: https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
Resource:
x_transferred
Hyperlink: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
Resource:
x_transferred
Hyperlink: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
Resource:
x_transferred
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2294604
Resource:
issue-tracking
x_refsource_REDHAT
x_transferred
Hyperlink: https://explore.alas.aws.amazon.com/CVE-2024-6387.html
Resource:
x_transferred
Hyperlink: https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132
Resource:
x_transferred
Hyperlink: https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc
Resource:
x_transferred
Hyperlink: https://github.com/AlmaLinux/updates/issues/629
Resource:
x_transferred
Hyperlink: https://github.com/Azure/AKS/issues/4379
Resource:
x_transferred
Hyperlink: https://github.com/PowerShell/Win32-OpenSSH/discussions/2248
Resource:
x_transferred
Hyperlink: https://github.com/PowerShell/Win32-OpenSSH/issues/2249
Resource:
x_transferred
Hyperlink: https://github.com/microsoft/azurelinux/issues/9555
Resource:
x_transferred
Hyperlink: https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09
Resource:
x_transferred
Hyperlink: https://github.com/oracle/oracle-linux/issues/149
Resource:
x_transferred
Hyperlink: https://github.com/rapier1/hpn-ssh/issues/87
Resource:
x_transferred
Hyperlink: https://github.com/zgzhang/cve-2024-6387-poc
Resource:
x_transferred
Hyperlink: https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/
Resource:
x_transferred
Hyperlink: https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
Resource:
x_transferred
Hyperlink: https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
Resource:
x_transferred
Hyperlink: https://news.ycombinator.com/item?id=40843778
Resource:
x_transferred
Hyperlink: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
Resource:
x_transferred
Hyperlink: https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
Resource:
x_transferred
Hyperlink: https://security-tracker.debian.org/tracker/CVE-2024-6387
Resource:
x_transferred
Hyperlink: https://security.netapp.com/advisory/ntap-20240701-0001/
Resource:
x_transferred
Hyperlink: https://sig-security.rocky.page/issues/CVE-2024-6387/
Resource:
x_transferred
Hyperlink: https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
Resource:
x_transferred
Hyperlink: https://ubuntu.com/security/CVE-2024-6387
Resource:
x_transferred
Hyperlink: https://ubuntu.com/security/notices/USN-6859-1
Resource:
x_transferred
Hyperlink: https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do
Resource:
x_transferred
Hyperlink: https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100
Resource:
x_transferred
Hyperlink: https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc
Resource:
x_transferred
Hyperlink: https://www.openssh.com/txt/release-9.8
Resource:
x_transferred
Hyperlink: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Resource:
x_transferred
Hyperlink: https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html
Resource:
x_transferred
Hyperlink: https://www.suse.com/security/cve/CVE-2024-6387.html
Resource:
x_transferred
Hyperlink: https://www.theregister.com/2024/07/01/regresshion_openssh/
Resource:
x_transferred
Hyperlink: https://support.apple.com/kb/HT214119
Resource:
x_transferred
Hyperlink: https://support.apple.com/kb/HT214118
Resource:
x_transferred
Hyperlink: https://support.apple.com/kb/HT214120
Resource:
x_transferred
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/20
Resource:
x_transferred
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18
Resource:
x_transferred
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/19
Resource:
x_transferred
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:secalert@redhat.com
Published At:01 Jul, 2024 | 13:15
Updated At:24 Apr, 2025 | 19:15

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary3.18.1HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 3.1
Base score: 8.1
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches

OpenBSD
openbsd
>>openssh>>Versions before 4.4(exclusive)
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
OpenBSD
openbsd
>>openssh>>Versions from 8.6(inclusive) to 9.8(exclusive)
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*
OpenBSD
openbsd
>>openssh>>4.4
cpe:2.3:a:openbsd:openssh:4.4:-:*:*:*:*:*:*
OpenBSD
openbsd
>>openssh>>8.5
cpe:2.3:a:openbsd:openssh:8.5:p1:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>openshift_container_platform>>4.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux>>9.0
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_eus>>9.4
cpe:2.3:o:redhat:enterprise_linux_eus:9.4:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_arm_64>>9.0_aarch64
cpe:2.3:o:redhat:enterprise_linux_for_arm_64:9.0_aarch64:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_arm_64_eus>>9.4_aarch64
cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:9.4_aarch64:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_ibm_z_systems>>9.0_s390x
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:9.0_s390x:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_ibm_z_systems_eus>>9.4_s390x
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.4_s390x:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_power_little_endian>>9.0_ppc64le
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:9.0_ppc64le:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_for_power_little_endian_eus>>9.4_ppc64le
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.4_ppc64le:*:*:*:*:*:*:*
Red Hat, Inc.
redhat
>>enterprise_linux_server_aus>>9.4
cpe:2.3:o:redhat:enterprise_linux_server_aus:9.4:*:*:*:*:*:*:*
SUSE
suse
>>linux_enterprise_micro>>6.0
cpe:2.3:o:suse:linux_enterprise_micro:6.0:*:*:*:*:*:*:*
Debian GNU/Linux
debian
>>debian_linux>>12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>22.04
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>22.10
cpe:2.3:o:canonical:ubuntu_linux:22.10:*:*:*:-:*:*:*
Canonical Ltd.
canonical
>>ubuntu_linux>>23.04
cpe:2.3:o:canonical:ubuntu_linux:23.04:*:*:*:lts:*:*:*
amazon
amazon
>>linux_2023>>-
cpe:2.3:o:amazon:linux_2023:-:*:*:*:*:*:*:*
NetApp, Inc.
netapp
>>e-series_santricity_os_controller>>Versions from 11.0.0(inclusive) to 11.70.2(inclusive)
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*
NetApp, Inc.
netapp
>>ontap_select_deploy_administration_utility>>-
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
NetApp, Inc.
netapp
>>ontap_tools>>9
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:-:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p1:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p10:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p11:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p2:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p3:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p4:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p5:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p6:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p7:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p8:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.2
cpe:2.3:o:freebsd:freebsd:13.2:p9:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.3
cpe:2.3:o:freebsd:freebsd:13.3:-:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.3
cpe:2.3:o:freebsd:freebsd:13.3:p1:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.3
cpe:2.3:o:freebsd:freebsd:13.3:p2:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>13.3
cpe:2.3:o:freebsd:freebsd:13.3:p3:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:-:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:beta5:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p1:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p2:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p3:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p4:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p5:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p6:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:p7:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:rc3:*:*:*:*:*:*
FreeBSD Foundation
freebsd
>>freebsd>>14.0
cpe:2.3:o:freebsd:freebsd:14.0:rc4-p1:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-364Secondarysecalert@redhat.com
CWE-362Primarynvd@nist.gov
CWE ID: CWE-364
Type: Secondary
Source: secalert@redhat.com
CWE ID: CWE-362
Type: Primary
Source: nvd@nist.gov
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://access.redhat.com/errata/RHSA-2024:4312secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4469secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4474secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4479secalert@redhat.com
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4484secalert@redhat.com
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387secalert@redhat.com
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2294604secalert@redhat.com
Issue Tracking
Third Party Advisory
https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlsecalert@redhat.com
N/A
https://www.openssh.com/txt/release-9.8secalert@redhat.com
Release Notes
Third Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtsecalert@redhat.com
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/18af854a3a-2127-422b-91ae-364da2661108
N/A
http://seclists.org/fulldisclosure/2024/Jul/19af854a3a-2127-422b-91ae-364da2661108
N/A
http://seclists.org/fulldisclosure/2024/Jul/20af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/01/12af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/01/13af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/02/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/11af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/03/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/04/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/04/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/08/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/08/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/09/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/09/5af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/10/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/10/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/10/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/10/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/10/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/11/1af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/11/3af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/23/4af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/23/6af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/28/2af854a3a-2127-422b-91ae-364da2661108
N/A
http://www.openwall.com/lists/oss-security/2024/07/28/3af854a3a-2127-422b-91ae-364da2661108
N/A
https://access.redhat.com/errata/RHSA-2024:4312af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4340af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4389af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4469af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4474af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4479af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:4484af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-6387af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/af854a3a-2127-422b-91ae-364da2661108
N/A
https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/af854a3a-2127-422b-91ae-364da2661108
N/A
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-serveraf854a3a-2127-422b-91ae-364da2661108
N/A
https://bugzilla.redhat.com/show_bug.cgi?id=2294604af854a3a-2127-422b-91ae-364da2661108
Issue Tracking
Third Party Advisory
https://explore.alas.aws.amazon.com/CVE-2024-6387.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132af854a3a-2127-422b-91ae-364da2661108
N/A
https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.ascaf854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/AlmaLinux/updates/issues/629af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/Azure/AKS/issues/4379af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/PowerShell/Win32-OpenSSH/discussions/2248af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/PowerShell/Win32-OpenSSH/issues/2249af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/microsoft/azurelinux/issues/9555af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/oracle/oracle-linux/issues/149af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/rapier1/hpn-ssh/issues/87af854a3a-2127-422b-91ae-364da2661108
N/A
https://github.com/zgzhang/cve-2024-6387-pocaf854a3a-2127-422b-91ae-364da2661108
N/A
https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/af854a3a-2127-422b-91ae-364da2661108
N/A
https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://news.ycombinator.com/item?id=40843778af854a3a-2127-422b-91ae-364da2661108
N/A
https://packetstorm.news/files/id/190587/af854a3a-2127-422b-91ae-364da2661108
N/A
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010af854a3a-2127-422b-91ae-364da2661108
N/A
https://santandersecurityresearch.github.io/blog/sshing_the_masses.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://security-tracker.debian.org/tracker/CVE-2024-6387af854a3a-2127-422b-91ae-364da2661108
N/A
https://security.netapp.com/advisory/ntap-20240701-0001/af854a3a-2127-422b-91ae-364da2661108
N/A
https://sig-security.rocky.page/issues/CVE-2024-6387/af854a3a-2127-422b-91ae-364da2661108
N/A
https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/af854a3a-2127-422b-91ae-364da2661108
N/A
https://support.apple.com/kb/HT214118af854a3a-2127-422b-91ae-364da2661108
N/A
https://support.apple.com/kb/HT214119af854a3a-2127-422b-91ae-364da2661108
N/A
https://support.apple.com/kb/HT214120af854a3a-2127-422b-91ae-364da2661108
N/A
https://ubuntu.com/security/CVE-2024-6387af854a3a-2127-422b-91ae-364da2661108
N/A
https://ubuntu.com/security/notices/USN-6859-1af854a3a-2127-422b-91ae-364da2661108
N/A
https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-doaf854a3a-2127-422b-91ae-364da2661108
N/A
https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100af854a3a-2127-422b-91ae-364da2661108
N/A
https://www.exploit-db.com/exploits/52269af854a3a-2127-422b-91ae-364da2661108
N/A
https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.ascaf854a3a-2127-422b-91ae-364da2661108
N/A
https://www.openssh.com/txt/release-9.8af854a3a-2127-422b-91ae-364da2661108
Release Notes
Third Party Advisory
https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txtaf854a3a-2127-422b-91ae-364da2661108
Exploit
Third Party Advisory
https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://www.suse.com/security/cve/CVE-2024-6387.htmlaf854a3a-2127-422b-91ae-364da2661108
N/A
https://www.theregister.com/2024/07/01/regresshion_openssh/af854a3a-2127-422b-91ae-364da2661108
N/A
https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387af854a3a-2127-422b-91ae-364da2661108
N/A
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4312
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4340
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4389
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4469
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4474
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4479
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4484
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/security/cve/CVE-2024-6387
Source: secalert@redhat.com
Resource:
Third Party Advisory
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2294604
Source: secalert@redhat.com
Resource:
Issue Tracking
Third Party Advisory
Hyperlink: https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
Source: secalert@redhat.com
Resource: N/A
Hyperlink: https://www.openssh.com/txt/release-9.8
Source: secalert@redhat.com
Resource:
Release Notes
Third Party Advisory
Hyperlink: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Source: secalert@redhat.com
Resource:
Exploit
Third Party Advisory
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/18
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/19
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://seclists.org/fulldisclosure/2024/Jul/20
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/01/12
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/01/13
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/02/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/11
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/03/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/04/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/04/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/08/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/08/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/09/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/09/5
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/10/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/11/1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/11/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/23/4
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/23/6
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/28/2
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: http://www.openwall.com/lists/oss-security/2024/07/28/3
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4312
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4340
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4389
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4469
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4474
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4479
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/errata/RHSA-2024:4484
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://access.redhat.com/security/cve/CVE-2024-6387
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Third Party Advisory
Hyperlink: https://archlinux.org/news/the-sshd-service-needs-to-be-restarted-after-upgrading-to-openssh-98p1/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://arstechnica.com/security/2024/07/regresshion-vulnerability-in-openssh-gives-attackers-root-on-linux/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2294604
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Issue Tracking
Third Party Advisory
Hyperlink: https://explore.alas.aws.amazon.com/CVE-2024-6387.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://forum.vmssoftware.com/viewtopic.php?f=8&t=9132
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2024-002.txt.asc
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/AlmaLinux/updates/issues/629
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/Azure/AKS/issues/4379
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/PowerShell/Win32-OpenSSH/discussions/2248
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/PowerShell/Win32-OpenSSH/issues/2249
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/microsoft/azurelinux/issues/9555
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/openela-main/openssh/commit/e1f438970e5a337a17070a637c1b9e19697cad09
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/oracle/oracle-linux/issues/149
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/rapier1/hpn-ssh/issues/87
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://github.com/zgzhang/cve-2024-6387-poc
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://lists.almalinux.org/archives/list/announce@lists.almalinux.org/thread/23BF5BMGFVEVUI2WNVAGMLKT557EU7VY/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://lists.mindrot.org/pipermail/openssh-unix-dev/2024-July/041431.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://news.ycombinator.com/item?id=40843778
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://packetstorm.news/files/id/190587/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0010
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://santandersecurityresearch.github.io/blog/sshing_the_masses.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://security-tracker.debian.org/tracker/CVE-2024-6387
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://security.netapp.com/advisory/ntap-20240701-0001/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://sig-security.rocky.page/issues/CVE-2024-6387/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://stackdiary.com/openssh-race-condition-in-sshd-allows-remote-code-execution/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://support.apple.com/kb/HT214118
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://support.apple.com/kb/HT214119
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://support.apple.com/kb/HT214120
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://ubuntu.com/security/CVE-2024-6387
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://ubuntu.com/security/notices/USN-6859-1
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.akamai.com/blog/security-research/2024-openssh-vulnerability-regression-what-to-know-and-do
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.arista.com/en/support/advisories-notices/security-advisory/19904-security-advisory-0100
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.exploit-db.com/exploits/52269
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.freebsd.org/security/advisories/FreeBSD-SA-24:04.openssh.asc
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.openssh.com/txt/release-9.8
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Release Notes
Third Party Advisory
Hyperlink: https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
Source: af854a3a-2127-422b-91ae-364da2661108
Resource:
Exploit
Third Party Advisory
Hyperlink: https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.suse.com/security/cve/CVE-2024-6387.html
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.theregister.com/2024/07/01/regresshion_openssh/
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A
Hyperlink: https://www.vicarius.io/vsociety/posts/regresshion-an-openssh-regression-error-cve-2024-6387
Source: af854a3a-2127-422b-91ae-364da2661108
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

557Records found

CVE-2017-7543
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.3||MEDIUM
EPSS-0.44% / 62.32%
||
7 Day CHG~0.00%
Published-26 Jul, 2018 | 14:00
Updated-05 Aug, 2024 | 16:04
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.

Action-Not Available
Vendor-OpenStackRed Hat, Inc.
Product-openstackneutronenterprise_linuxopenstack-neutron
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2017-6512
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-1.38% / 79.53%
||
7 Day CHG~0.00%
Published-01 Jun, 2017 | 16:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.

Action-Not Available
Vendor-file\n/aDebian GNU/LinuxCanonical Ltd.
Product-ubuntu_linux\debian_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-44731
Matching Score-6
Assigner-Canonical Ltd.
ShareView Details
Matching Score-6
Assigner-Canonical Ltd.
CVSS Score-7.8||HIGH
EPSS-2.30% / 84.08%
||
7 Day CHG~0.00%
Published-17 Feb, 2022 | 00:00
Updated-04 Aug, 2024 | 04:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
snapd could be made to escalate privileges and run programs as administrator

A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04, 2.54.3+20.04 and 2.54.3+21.10.1

Action-Not Available
Vendor-Canonical Ltd.Fedora ProjectDebian GNU/Linux
Product-snapdubuntu_linuxfedoradebian_linuxsnapd
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-43980
Matching Score-6
Assigner-Apache Software Foundation
ShareView Details
Matching Score-6
Assigner-Apache Software Foundation
CVSS Score-3.7||LOW
EPSS-0.16% / 37.59%
||
7 Day CHG~0.00%
Published-28 Sep, 2022 | 00:00
Updated-21 May, 2025 | 15:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Apache Tomcat: Information disclosure

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing (but extremely hard to trigger) concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5.0 to 8.5.77 that could cause client connections to share an Http11Processor instance resulting in responses, or part responses, to be received by the wrong client.

Action-Not Available
Vendor-The Apache Software FoundationDebian GNU/Linux
Product-debian_linuxtomcatApache Tomcat
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2017-5068
Matching Score-6
Assigner-Chrome
ShareView Details
Matching Score-6
Assigner-Chrome
CVSS Score-7.5||HIGH
EPSS-0.41% / 60.77%
||
7 Day CHG~0.00%
Published-27 Oct, 2017 | 05:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncRed Hat, Inc.Apple Inc.Microsoft CorporationGoogle LLC
Product-chromeenterprise_linux_desktopenterprise_linux_workstationlinux_kernelenterprise_linux_servermacoswindowsGoogle Chrome prior to 58.0.3029.96 for Mac, Windows and Linux
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-43538
Matching Score-6
Assigner-Mozilla Corporation
ShareView Details
Matching Score-6
Assigner-Mozilla Corporation
CVSS Score-4.3||MEDIUM
EPSS-0.23% / 45.35%
||
7 Day CHG~0.00%
Published-08 Dec, 2021 | 21:20
Updated-04 Aug, 2024 | 04:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95.

Action-Not Available
Vendor-Debian GNU/LinuxMozilla Corporation
Product-firefoxthunderbirddebian_linuxfirefox_esrThunderbirdFirefox ESRFirefox
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2011-0695
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.7||MEDIUM
EPSS-0.44% / 62.37%
||
7 Day CHG~0.00%
Published-15 Mar, 2011 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the cm_work_handler function in the InfiniBand driver (drivers/infiniband/core/cma.c) in Linux kernel 2.6.x allows remote attackers to cause a denial of service (panic) by sending an InfiniBand request while other request handlers are still running, which triggers an invalid pointer dereference.

Action-Not Available
Vendor-n/aRed Hat, Inc.Linux Kernel Organization, IncCanonical Ltd.
Product-linux_kernelubuntu_linuxenterprise_linux_workstationenterprise_linux_serverenterprise_linux_desktopenterprise_linux_server_ausenterprise_linux_eusn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2017-2636
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7||HIGH
EPSS-0.53% / 66.05%
||
7 Day CHG~0.00%
Published-07 Mar, 2017 | 22:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline.

Action-Not Available
Vendor-n/aDebian GNU/LinuxLinux Kernel Organization, Inc
Product-linux_kerneldebian_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-415
Double Free
CVE-2019-5840
Matching Score-6
Assigner-Chrome
ShareView Details
Matching Score-6
Assigner-Chrome
CVSS Score-4.3||MEDIUM
EPSS-0.62% / 68.97%
||
7 Day CHG~0.00%
Published-27 Jun, 2019 | 16:13
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Incorrect security UI in popup blocker in Google Chrome on iOS prior to 75.0.3770.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Action-Not Available
Vendor-Google LLCopenSUSEApple Inc.Fedora ProjectDebian GNU/Linux
Product-iphone_osdebian_linuxchromefedorabackportsleapChrome
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-4207
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-8.2||HIGH
EPSS-0.04% / 11.03%
||
7 Day CHG~0.00%
Published-29 Apr, 2022 | 16:07
Updated-21 Mar, 2025 | 18:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

Action-Not Available
Vendor-n/aRed Hat, Inc.Debian GNU/LinuxQEMU
Product-debian_linuxqemuenterprise_linuxQEMU
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2017-2616
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.06% / 19.27%
||
7 Day CHG~0.00%
Published-27 Jul, 2018 | 19:00
Updated-09 Jun, 2025 | 15:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.

Action-Not Available
Vendor-util-linux_projectLinux Kernel Organization, IncDebian GNU/LinuxRed Hat, Inc.
Product-enterprise_linux_serverdebian_linuxenterprise_linux_server_eusenterprise_linux_server_ausenterprise_linux_workstationenterprise_linux_desktoputil-linuxutil-linux
CWE ID-CWE-267
Privilege Defined With Unsafe Actions
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-4203
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.06% / 17.46%
||
7 Day CHG-0.00%
Published-25 Mar, 2022 | 00:00
Updated-03 Aug, 2024 | 17:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

Action-Not Available
Vendor-n/aNetApp, Inc.Linux Kernel Organization, IncOracle Corporation
Product-bootstrap_osa700s_firmwareh500sh300s_firmwareh410c_firmwareactive_iq_unified_managercommunications_cloud_native_core_network_exposure_functionh410sh300shci_compute_nodecommunications_cloud_native_core_policyelement_softwaresolidfirelinux_kernelhci_management_nodeh410s_firmwaree-series_santricity_os_controllerh500s_firmwareh700s_firmwarecommunications_cloud_native_core_binding_support_functiona700sh410ch700skernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-416
Use After Free
CVE-2013-4481
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-1.9||LOW
EPSS-0.03% / 7.58%
||
7 Day CHG~0.00%
Published-23 Nov, 2013 | 11:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in Luci 0.26.0 creates /var/lib/luci/etc/luci.ini with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as "authentication secrets."

Action-Not Available
Vendor-scientificlinuxn/aRed Hat, Inc.
Product-enterprise_linuxlucin/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2017-18249
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-7||HIGH
EPSS-0.07% / 22.41%
||
7 Day CHG~0.00%
Published-26 Mar, 2018 | 20:00
Updated-05 Aug, 2024 | 21:13
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

The add_free_nid function in fs/f2fs/node.c in the Linux kernel before 4.12 does not properly track an allocated nid, which allows local users to cause a denial of service (race condition) or possibly have unspecified other impact via concurrent threads.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncDebian GNU/Linux
Product-debian_linuxlinux_kerneln/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2019-6133
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.7||MEDIUM
EPSS-0.02% / 4.47%
||
7 Day CHG~0.00%
Published-11 Jan, 2019 | 14:00
Updated-04 Aug, 2024 | 20:16
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached. This is related to lack of uid checking in polkitbackend/polkitbackendinteractiveauthority.c.

Action-Not Available
Vendor-polkit_projectn/aCanonical Ltd.Red Hat, Inc.Debian GNU/Linux
Product-enterprise_linux_serverubuntu_linuxdebian_linuxenterprise_linux_server_eusenterprise_linux_server_ausenterprise_linux_workstationpolkitenterprise_linux_server_tusenterprise_linux_desktopn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2013-4327
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.04% / 11.74%
||
7 Day CHG~0.00%
Published-03 Oct, 2013 | 21:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.

Action-Not Available
Vendor-systemd_projectn/aDebian GNU/LinuxCanonical Ltd.
Product-debian_linuxsystemdubuntu_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2013-1935
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.7||MEDIUM
EPSS-0.23% / 45.26%
||
7 Day CHG~0.00%
Published-16 Jul, 2013 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-enterprise_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2013-2162
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-1.9||LOW
EPSS-0.03% / 7.84%
||
7 Day CHG~0.00%
Published-19 Aug, 2013 | 00:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux creates a configuration file with world-readable permissions before restricting the permissions, which allows local users to read the file and obtain sensitive information such as credentials.

Action-Not Available
Vendor-n/aCanonical Ltd.
Product-ubuntu_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-40490
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-7||HIGH
EPSS-0.04% / 9.59%
||
7 Day CHG~0.00%
Published-03 Sep, 2021 | 00:50
Updated-04 Aug, 2024 | 02:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncNetApp, Inc.Fedora ProjectDebian GNU/Linux
Product-h300eh500sfas_500f_firmwareh615c_firmwareh300s_firmwareh410c_firmwareh410sh610s_firmwareh300sh300e_firmwareh610sdebian_linuxlinux_kernelh500eh410s_firmwarefedorah500s_firmwareh500e_firmwareh610ch700s_firmwareaff_a250h700efas_500fh700e_firmwareh615ch410ch700sh610c_firmwareaff_a250_firmwaren/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2012-5660
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.03% / 6.29%
||
7 Day CHG~0.00%
Published-12 Mar, 2013 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

abrt-action-install-debuginfo in Automatic Bug Reporting Tool (ABRT) 2.0.9 and earlier allows local users to set world-writable permissions for arbitrary files and possibly gain privileges via a symlink attack on "the directories used to store information about crashes."

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-automatic_bug_reporting_tooln/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2017-15037
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-8.1||HIGH
EPSS-0.36% / 57.55%
||
7 Day CHG~0.00%
Published-05 Oct, 2017 | 07:00
Updated-20 Apr, 2025 | 01:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In FreeBSD through 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition with a resultant out-of-bounds read, because it can cause t2p->t_name strings to lack a final '\0' character.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdn/a
CWE ID-CWE-125
Out-of-bounds Read
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2012-3552
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.9||MEDIUM
EPSS-2.04% / 83.11%
||
7 Day CHG~0.00%
Published-03 Oct, 2012 | 10:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.

Action-Not Available
Vendor-n/aRed Hat, Inc.Linux Kernel Organization, Inc
Product-linux_kernelenterprise_linux_eusn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2014-5255
Matching Score-6
Assigner-Debian GNU/Linux
ShareView Details
Matching Score-6
Assigner-Debian GNU/Linux
CVSS Score-7||HIGH
EPSS-0.09% / 26.07%
||
7 Day CHG~0.00%
Published-21 Nov, 2019 | 22:30
Updated-06 Aug, 2024 | 11:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.

Action-Not Available
Vendor-xcfa_projectxcfaDebian GNU/Linux
Product-xcfadebian_linuxxcfa
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-3752
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7.1||HIGH
EPSS-0.03% / 7.07%
||
7 Day CHG~0.00%
Published-16 Feb, 2022 | 18:35
Updated-03 Aug, 2024 | 17:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Action-Not Available
Vendor-n/aFedora ProjectRed Hat, Inc.Linux Kernel Organization, IncNetApp, Inc.Debian GNU/LinuxOracle Corporation
Product-3scaleh300eh500senterprise_linuxvirtualization_hosth300s_firmwareh410c_firmwarecommunications_cloud_native_core_network_exposure_functionh410senterprise_linux_for_real_time_for_nfvh300scommunications_cloud_native_core_policyh300e_firmwaredebian_linuxlinux_kernelh500eh410s_firmwarefedorah500s_firmwareh500e_firmwareh700s_firmwarecommunications_cloud_native_core_binding_support_functionh700eh410ch700e_firmwareh700senterprise_linux_for_real_timekernel
CWE ID-CWE-416
Use After Free
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-3609
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7||HIGH
EPSS-0.06% / 20.10%
||
7 Day CHG~0.00%
Published-03 Mar, 2022 | 18:24
Updated-03 Aug, 2024 | 17:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.

Action-Not Available
Vendor-n/aNetApp, Inc.Linux Kernel Organization, IncRed Hat, Inc.
Product-codeready_linux_builder_for_power_little_endian_eusopenshift_container_platformenterprise_linux_server_ausvirtualization_hosth300s_firmwareh410c_firmwareh410sh610s_firmwareh300sbuild_of_quarkusenterprise_linux_for_ibm_z_systems_eus_s390xh300e_firmwareh610sh500eh500s_firmwareh500e_firmwareenterprise_linux_eusenterprise_linux_server_for_power_little_endian_update_services_for_sap_solutionsh700eh700senterprise_linux_for_ibm_z_systems_eush610c_firmwareh610ch300evirtualizationenterprise_linux_server_update_services_for_sap_solutionsh500sh615c_firmwareenterprise_linux_aus3scale_api_managemententerprise_linux_for_real_time_for_nfventerprise_linux_for_real_time_tuslinux_kernelh410s_firmwareh700s_firmwareh615centerprise_linux_for_power_little_endian_eush410centerprise_linux_server_tush700e_firmwareenterprise_linux_for_real_time_for_nfv_tusenterprise_linux_for_real_timecodeready_linux_builder_euskernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-3640
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7||HIGH
EPSS-0.01% / 0.21%
||
7 Day CHG-0.00%
Published-03 Mar, 2022 | 22:04
Updated-03 Aug, 2024 | 17:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sendmsg() with the expected controllable faulting memory page. A privileged local user could use this flaw to crash the system or escalate their privileges on the system.

Action-Not Available
Vendor-n/aFedora ProjectCanonical Ltd.Linux Kernel Organization, IncNetApp, Inc.Debian GNU/Linux
Product-ubuntu_linuxh300eh500sh300s_firmwareh410c_firmwareh410sh300sh300e_firmwaredebian_linuxlinux_kernelh500eh410s_firmwarefedorah500s_firmwareh500e_firmwareh700s_firmwareh700eh410ch700e_firmwareh700skernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-416
Use After Free
CVE-2021-3597
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.9||MEDIUM
EPSS-0.16% / 37.66%
||
7 Day CHG~0.00%
Published-24 May, 2022 | 18:19
Updated-03 Aug, 2024 | 17:01
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.

Action-Not Available
Vendor-n/aRed Hat, Inc.NetApp, Inc.
Product-single_sign-onopenshift_application_runtimesenterprise_linuxactive_iq_unified_managerundertowoncommand_workflow_automationjboss_enterprise_application_platformfuseoncommand_insightundertow
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-36221
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-5.9||MEDIUM
EPSS-0.17% / 38.25%
||
7 Day CHG~0.00%
Published-08 Aug, 2021 | 00:00
Updated-04 Aug, 2024 | 00:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

Action-Not Available
Vendor-n/aOracle CorporationFedora ProjectSiemens AGDebian GNU/LinuxGo
Product-scalance_lpe9403_firmwaredebian_linuxscalance_lpe9403fedoragotimesten_in-memory_databasen/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2019-3805
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-5.5||MEDIUM
EPSS-0.04% / 11.77%
||
7 Day CHG~0.00%
Published-03 May, 2019 | 19:25
Updated-04 Aug, 2024 | 19:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.

Action-Not Available
Vendor-Red Hat, Inc.
Product-jboss_enterprise_application_platformwildflywildfly
CWE ID-CWE-364
Signal Handler Race Condition
CWE ID-CWE-269
Improper Privilege Management
CVE-2017-14798
Matching Score-6
Assigner-OpenText (formerly Micro Focus)
ShareView Details
Matching Score-6
Assigner-OpenText (formerly Micro Focus)
CVSS Score-7.3||HIGH
EPSS-0.40% / 60.04%
||
7 Day CHG~0.00%
Published-01 Mar, 2018 | 19:00
Updated-16 Sep, 2024 | 19:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
local privilege escalation in SUSE postgresql init script

A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.

Action-Not Available
Vendor-The PostgreSQL Global Development GroupSUSE
Product-postgresqlsuse_linux_enterprise_serverpostgresql-init
CWE ID-CWE-61
UNIX Symbolic Link (Symlink) Following
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-35898
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-5.5||MEDIUM
EPSS-0.01% / 0.69%
||
7 Day CHG-0.00%
Published-19 May, 2024 | 08:34
Updated-04 May, 2025 | 09:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() nft_unregister_flowtable_type() within nf_flow_inet_module_exit() can concurrent with __nft_flowtable_type_get() within nf_tables_newflowtable(). And thhere is not any protection when iterate over nf_tables_flowtables list in __nft_flowtable_type_get(). Therefore, there is pertential data-race of nf_tables_flowtables list entry. Use list_for_each_entry_rcu() to iterate over nf_tables_flowtables list in __nft_flowtable_type_get(), and use rcu_read_lock() in the caller nft_flowtable_type_get() to protect the entire type query process.

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinux
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-35899
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-6.1||MEDIUM
EPSS-0.01% / 0.78%
||
7 Day CHG~0.00%
Published-19 May, 2024 | 08:34
Updated-04 May, 2025 | 09:07
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
netfilter: nf_tables: flush pending destroy work before exit_net release

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: flush pending destroy work before exit_net release Similar to 2c9f0293280e ("netfilter: nf_tables: flush pending destroy work before netlink notifier") to address a race between exit_net and the destroy workqueue. The trace below shows an element to be released via destroy workqueue while exit_net path (triggered via module removal) has already released the set that is used in such transaction. [ 1360.547789] BUG: KASAN: slab-use-after-free in nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.547861] Read of size 8 at addr ffff888140500cc0 by task kworker/4:1/152465 [ 1360.547870] CPU: 4 PID: 152465 Comm: kworker/4:1 Not tainted 6.8.0+ #359 [ 1360.547882] Workqueue: events nf_tables_trans_destroy_work [nf_tables] [ 1360.547984] Call Trace: [ 1360.547991] <TASK> [ 1360.547998] dump_stack_lvl+0x53/0x70 [ 1360.548014] print_report+0xc4/0x610 [ 1360.548026] ? __virt_addr_valid+0xba/0x160 [ 1360.548040] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 1360.548054] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548176] kasan_report+0xae/0xe0 [ 1360.548189] ? nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548312] nf_tables_trans_destroy_work+0x3f5/0x590 [nf_tables] [ 1360.548447] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [nf_tables] [ 1360.548577] ? _raw_spin_unlock_irq+0x18/0x30 [ 1360.548591] process_one_work+0x2f1/0x670 [ 1360.548610] worker_thread+0x4d3/0x760 [ 1360.548627] ? __pfx_worker_thread+0x10/0x10 [ 1360.548640] kthread+0x16b/0x1b0 [ 1360.548653] ? __pfx_kthread+0x10/0x10 [ 1360.548665] ret_from_fork+0x2f/0x50 [ 1360.548679] ? __pfx_kthread+0x10/0x10 [ 1360.548690] ret_from_fork_asm+0x1a/0x30 [ 1360.548707] </TASK> [ 1360.548719] Allocated by task 192061: [ 1360.548726] kasan_save_stack+0x20/0x40 [ 1360.548739] kasan_save_track+0x14/0x30 [ 1360.548750] __kasan_kmalloc+0x8f/0xa0 [ 1360.548760] __kmalloc_node+0x1f1/0x450 [ 1360.548771] nf_tables_newset+0x10c7/0x1b50 [nf_tables] [ 1360.548883] nfnetlink_rcv_batch+0xbc4/0xdc0 [nfnetlink] [ 1360.548909] nfnetlink_rcv+0x1a8/0x1e0 [nfnetlink] [ 1360.548927] netlink_unicast+0x367/0x4f0 [ 1360.548935] netlink_sendmsg+0x34b/0x610 [ 1360.548944] ____sys_sendmsg+0x4d4/0x510 [ 1360.548953] ___sys_sendmsg+0xc9/0x120 [ 1360.548961] __sys_sendmsg+0xbe/0x140 [ 1360.548971] do_syscall_64+0x55/0x120 [ 1360.548982] entry_SYSCALL_64_after_hwframe+0x55/0x5d [ 1360.548994] Freed by task 192222: [ 1360.548999] kasan_save_stack+0x20/0x40 [ 1360.549009] kasan_save_track+0x14/0x30 [ 1360.549019] kasan_save_free_info+0x3b/0x60 [ 1360.549028] poison_slab_object+0x100/0x180 [ 1360.549036] __kasan_slab_free+0x14/0x30 [ 1360.549042] kfree+0xb6/0x260 [ 1360.549049] __nft_release_table+0x473/0x6a0 [nf_tables] [ 1360.549131] nf_tables_exit_net+0x170/0x240 [nf_tables] [ 1360.549221] ops_exit_list+0x50/0xa0 [ 1360.549229] free_exit_list+0x101/0x140 [ 1360.549236] unregister_pernet_operations+0x107/0x160 [ 1360.549245] unregister_pernet_subsys+0x1c/0x30 [ 1360.549254] nf_tables_module_exit+0x43/0x80 [nf_tables] [ 1360.549345] __do_sys_delete_module+0x253/0x370 [ 1360.549352] do_syscall_64+0x55/0x120 [ 1360.549360] entry_SYSCALL_64_after_hwframe+0x55/0x5d (gdb) list *__nft_release_table+0x473 0x1e033 is in __nft_release_table (net/netfilter/nf_tables_api.c:11354). 11349 list_for_each_entry_safe(flowtable, nf, &table->flowtables, list) { 11350 list_del(&flowtable->list); 11351 nft_use_dec(&table->use); 11352 nf_tables_flowtable_destroy(flowtable); 11353 } 11354 list_for_each_entry_safe(set, ns, &table->sets, list) { 11355 list_del(&set->list); 11356 nft_use_dec(&table->use); 11357 if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT)) 11358 nft_map_deactivat ---truncated---

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinuxlinux_kernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-28701
Matching Score-6
Assigner-Xen Project
ShareView Details
Matching Score-6
Assigner-Xen Project
CVSS Score-7.8||HIGH
EPSS-0.06% / 18.66%
||
7 Day CHG~0.00%
Published-08 Sep, 2021 | 13:02
Updated-03 Aug, 2024 | 21:47
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.

Action-Not Available
Vendor-Debian GNU/LinuxFedora ProjectXen Project
Product-xendebian_linuxfedoraxen
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-29265
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4.7||MEDIUM
EPSS-0.11% / 29.94%
||
7 Day CHG~0.00%
Published-26 Mar, 2021 | 21:35
Updated-03 Aug, 2024 | 22:02
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncDebian GNU/Linux
Product-debian_linuxlinux_kerneln/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-28964
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4.7||MEDIUM
EPSS-0.09% / 26.89%
||
7 Day CHG~0.00%
Published-22 Mar, 2021 | 07:17
Updated-03 Aug, 2024 | 21:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncNetApp, Inc.Fedora ProjectDebian GNU/Linux
Product-debian_linuxlinux_kernelcloud_backupfas_500f_firmwarefedoraaff_a250fas_500fsolidfire_baseboard_management_controller_firmwareaff_a250_firmwaren/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2003-1562
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-7.6||HIGH
EPSS-1.42% / 79.78%
||
7 Day CHG~0.00%
Published-04 Aug, 2008 | 10:00
Updated-03 Apr, 2025 | 01:03
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.

Action-Not Available
Vendor-n/aOpenBSD
Product-opensshn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2011-1075
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-3.7||LOW
EPSS-0.20% / 41.97%
||
7 Day CHG~0.00%
Published-19 Oct, 2021 | 14:08
Updated-06 Aug, 2024 | 22:14
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.

Action-Not Available
Vendor-n/aFreeBSD Foundation
Product-freebsdFreeBSD/crontab
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2011-1485
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.9||MEDIUM
EPSS-3.41% / 86.97%
||
7 Day CHG~0.00%
Published-31 May, 2011 | 20:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-policykitn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2011-1444
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-6.8||MEDIUM
EPSS-0.69% / 70.88%
||
7 Day CHG~0.00%
Published-03 May, 2011 | 22:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the sandbox launcher implementation in Google Chrome before 11.0.696.57 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Action-Not Available
Vendor-n/aLinux Kernel Organization, IncDebian GNU/LinuxGoogle LLC
Product-linux_kerneldebian_linuxchromen/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2010-5298
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4||MEDIUM
EPSS-10.66% / 93.01%
||
7 Day CHG~0.00%
Published-14 Apr, 2014 | 16:00
Updated-12 Apr, 2025 | 10:46
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.

Action-Not Available
Vendor-n/aMariaDB FoundationSUSEFedora ProjectOpenSSL
Product-fedoramariadblinux_enterprise_desktoplinux_enterprise_workstation_extensionopenssllinux_enterprise_serverlinux_enterprise_software_development_kitn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2010-4526
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7.1||HIGH
EPSS-2.06% / 83.16%
||
7 Day CHG~0.00%
Published-11 Jan, 2011 | 01:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the sctp_icmp_proto_unreachable function in net/sctp/input.c in Linux kernel 2.6.11-rc2 through 2.6.33 allows remote attackers to cause a denial of service (panic) via an ICMP unreachable message to a socket that is already locked by a user, which causes the socket to be freed and triggers list corruption, related to the sctp_wait_for_connect function.

Action-Not Available
Vendor-n/aRed Hat, Inc.VMware (Broadcom Inc.)Linux Kernel Organization, Inc
Product-linux_kernelenterprise_mrgesxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-26861
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-4.7||MEDIUM
EPSS-0.01% / 0.29%
||
7 Day CHG~0.00%
Published-17 Apr, 2024 | 10:27
Updated-04 May, 2025 | 12:55
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
wireguard: receive: annotate data-race around receiving_counter.counter

In the Linux kernel, the following vulnerability has been resolved: wireguard: receive: annotate data-race around receiving_counter.counter Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() and WRITE_ONCE() annotations to mark the data race as intentional. BUG: KCSAN: data-race in wg_packet_decrypt_worker / wg_packet_rx_poll write to 0xffff888107765888 of 8 bytes by interrupt on cpu 0: counter_validate drivers/net/wireguard/receive.c:321 [inline] wg_packet_rx_poll+0x3ac/0xf00 drivers/net/wireguard/receive.c:461 __napi_poll+0x60/0x3b0 net/core/dev.c:6536 napi_poll net/core/dev.c:6605 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6738 __do_softirq+0xc4/0x279 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x6c5/0x700 drivers/net/wireguard/receive.c:499 process_one_work kernel/workqueue.c:2633 [inline] ... read to 0xffff888107765888 of 8 bytes by task 3196 on cpu 1: decrypt_packet drivers/net/wireguard/receive.c:252 [inline] wg_packet_decrypt_worker+0x220/0x700 drivers/net/wireguard/receive.c:501 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2706 worker_thread+0x525/0x730 kernel/workqueue.c:2787 ...

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinux
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2010-2793
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.8||MEDIUM
EPSS-0.23% / 45.61%
||
7 Day CHG~0.00%
Published-08 Dec, 2010 | 17:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function.

Action-Not Available
Vendor-n/aRed Hat, Inc.
Product-spice-activexenterprise_virtualization_managern/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2010-2792
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-3.3||LOW
EPSS-0.05% / 14.51%
||
7 Day CHG~0.00%
Published-30 Aug, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to obtain sensitive information, and conduct man-in-the-middle attacks, by providing a UNIX socket for communication between this plug-in and the client (aka qspice-client) in qspice 0.3.0, and then accessing this socket.

Action-Not Available
Vendor-n/aMozilla CorporationRed Hat, Inc.
Product-spice-xpifirefoxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-26698
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-4.7||MEDIUM
EPSS-0.01% / 0.24%
||
7 Day CHG~0.00%
Published-03 Apr, 2024 | 14:54
Updated-04 May, 2025 | 08:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove

In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for all channels, including all subchannels without confirming if they are enabled or not. This caused hv_netvsc getting hung at napi_disable, when netvsc_probe() has finished running but nvdev->subchan_work has not started yet. netvsc_subchan_work() -> rndis_set_subchannel() has not created the sub-channels and because of that netvsc_sc_open() is not running. netvsc_remove() calls cancel_work_sync(&nvdev->subchan_work), for which netvsc_subchan_work did not run. netif_napi_add() sets the bit NAPI_STATE_SCHED because it ensures NAPI cannot be scheduled. Then netvsc_sc_open() -> napi_enable will clear the NAPIF_STATE_SCHED bit, so it can be scheduled. napi_disable() does the opposite. Now during netvsc_device_remove(), when napi_disable is called for those subchannels, napi_disable gets stuck on infinite msleep. This fix addresses this problem by ensuring that napi_disable() is not getting called for non-enabled NAPI struct. But netif_napi_del() is still necessary for these non-enabled NAPI struct for cleanup purpose. Call trace: [ 654.559417] task:modprobe state:D stack: 0 pid: 2321 ppid: 1091 flags:0x00004002 [ 654.568030] Call Trace: [ 654.571221] <TASK> [ 654.573790] __schedule+0x2d6/0x960 [ 654.577733] schedule+0x69/0xf0 [ 654.581214] schedule_timeout+0x87/0x140 [ 654.585463] ? __bpf_trace_tick_stop+0x20/0x20 [ 654.590291] msleep+0x2d/0x40 [ 654.593625] napi_disable+0x2b/0x80 [ 654.597437] netvsc_device_remove+0x8a/0x1f0 [hv_netvsc] [ 654.603935] rndis_filter_device_remove+0x194/0x1c0 [hv_netvsc] [ 654.611101] ? do_wait_intr+0xb0/0xb0 [ 654.615753] netvsc_remove+0x7c/0x120 [hv_netvsc] [ 654.621675] vmbus_remove+0x27/0x40 [hv_vmbus]

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinux
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-26960
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-5.5||MEDIUM
EPSS-0.01% / 0.23%
||
7 Day CHG~0.00%
Published-01 May, 2024 | 05:19
Updated-04 May, 2025 | 09:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
mm: swap: fix race between free_swap_and_cache() and swapoff()

In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_and_cache() was running in another thread. This could cause, amongst other bad possibilities, swap_page_trans_huge_swapped() (called by free_swap_and_cache()) to access the freed memory for swap_map. This is a theoretical problem and I haven't been able to provoke it from a test case. But there has been agreement based on code review that this is possible (see link below). Fix it by using get_swap_device()/put_swap_device(), which will stall swapoff(). There was an extra check in _swap_info_get() to confirm that the swap entry was not free. This isn't present in get_swap_device() because it doesn't make sense in general due to the race between getting the reference and swapoff. So I've added an equivalent check directly in free_swap_and_cache(). Details of how to provoke one possible issue (thanks to David Hildenbrand for deriving this): --8<----- __swap_entry_free() might be the last user and result in "count == SWAP_HAS_CACHE". swapoff->try_to_unuse() will stop as soon as soon as si->inuse_pages==0. So the question is: could someone reclaim the folio and turn si->inuse_pages==0, before we completed swap_page_trans_huge_swapped(). Imagine the following: 2 MiB folio in the swapcache. Only 2 subpages are still references by swap entries. Process 1 still references subpage 0 via swap entry. Process 2 still references subpage 1 via swap entry. Process 1 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE [then, preempted in the hypervisor etc.] Process 2 quits. Calls free_swap_and_cache(). -> count == SWAP_HAS_CACHE Process 2 goes ahead, passes swap_page_trans_huge_swapped(), and calls __try_to_reclaim_swap(). __try_to_reclaim_swap()->folio_free_swap()->delete_from_swap_cache()-> put_swap_folio()->free_swap_slot()->swapcache_free_entries()-> swap_entry_free()->swap_range_free()-> ... WRITE_ONCE(si->inuse_pages, si->inuse_pages - nr_entries); What stops swapoff to succeed after process 2 reclaimed the swap cache but before process1 finished its call to swap_page_trans_huge_swapped()? --8<-----

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinuxlinux_kernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2024-26671
Matching Score-6
Assigner-kernel.org
ShareView Details
Matching Score-6
Assigner-kernel.org
CVSS Score-4.7||MEDIUM
EPSS-0.01% / 0.85%
||
7 Day CHG~0.00%
Published-02 Apr, 2024 | 06:49
Updated-04 May, 2025 | 08:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
blk-mq: fix IO hang from sbitmap wakeup race

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_queue_wake_up(), waitqueue_active() may not observe the added waiter in blk_mq_mark_tag_wait() and wake up nothing, meantime blk_mq_mark_tag_wait() can't get driver tag successfully. This issue can be reproduced by running the following test in loop, and fio hang can be observed in < 30min when running it on my test VM in laptop. modprobe -r scsi_debug modprobe scsi_debug delay=0 dev_size_mb=4096 max_queue=1 host_max_queue=1 submit_queues=4 dev=`ls -d /sys/bus/pseudo/drivers/scsi_debug/adapter*/host*/target*/*/block/* | head -1 | xargs basename` fio --filename=/dev/"$dev" --direct=1 --rw=randrw --bs=4k --iodepth=1 \ --runtime=100 --numjobs=40 --time_based --name=test \ --ioengine=libaio Fix the issue by adding one explicit barrier in blk_mq_mark_tag_wait(), which is just fine in case of running out of tag.

Action-Not Available
Vendor-Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxLinux
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2010-1437
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-7||HIGH
EPSS-0.24% / 47.23%
||
7 Day CHG~0.00%
Published-07 May, 2010 | 18:23
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

Action-Not Available
Vendor-n/aSUSELinux Kernel Organization, IncDebian GNU/LinuxopenSUSE
Product-linux_kernelopensusedebian_linuxlinux_enterprise_serverlinux_enterprise_desktoplinux_enterprise_high_availability_extensionn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-416
Use After Free
CVE-2019-3837
Matching Score-6
Assigner-Red Hat, Inc.
ShareView Details
Matching Score-6
Assigner-Red Hat, Inc.
CVSS Score-6.1||MEDIUM
EPSS-0.09% / 26.96%
||
7 Day CHG~0.00%
Published-11 Apr, 2019 | 14:37
Updated-04 Aug, 2024 | 19:19
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

It was found that the net_dma code in tcp_recvmsg() in the 2.6.32 kernel as shipped in RHEL6 is thread-unsafe. So an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel executed on ioatdma-enabled hardware with net_dma enabled can leak the memory, crash the host leading to a denial-of-service or cause a random memory corruption.

Action-Not Available
Vendor-Linux Kernel Organization, IncRed Hat, Inc.The Linux Foundation
Product-enterprise_linuxlinux_kernelkernel
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-401
Missing Release of Memory after Effective Lifetime
CVE-2009-4895
Matching Score-6
Assigner-MITRE Corporation
ShareView Details
Matching Score-6
Assigner-MITRE Corporation
CVSS Score-4.7||MEDIUM
EPSS-0.06% / 20.10%
||
7 Day CHG~0.00%
Published-08 Sep, 2010 | 19:00
Updated-11 Apr, 2025 | 00:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors, related to the put_tty_queue and __f_setown functions. NOTE: the vulnerability was addressed in a different way in 2.6.32.9.

Action-Not Available
Vendor-n/aCanonical Ltd.Linux Kernel Organization, IncDebian GNU/Linux
Product-linux_kerneldebian_linuxubuntu_linuxn/a
CWE ID-CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE ID-CWE-476
NULL Pointer Dereference
  • Previous
  • 1
  • 2
  • 3
  • 4
  • 5
  • ...
  • 11
  • 12
  • Next
Details not found