CVE-2024-6387 is a critical security vulnerability in OpenSSH caused by a race condition in signal handling. Successful exploitation enables remote, unauthenticated attackers to execute arbitrary code as root on the target machine. The vulnerability affects OpenSSH version 8.5p1 and is present in glibc-based Linux distributions with exposed OpenSSH services. Red Hat has issued security advisories (RHSA-2024:4312 and RHSA-2024:4340) providing patches for multiple Red Hat Enterprise Linux 9 variants and extended update support versions. The advisories confirm the availability of fixes and provide guidance for applying updates. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability.

The vulnerability allows remote, unauthenticated attackers to execute arbitrary code with root privileges on affected systems running vulnerable OpenSSH versions. This can lead to full system compromise, including unauthorized access, data theft, and disruption of services. The CVSS score of 8.1 indicates a critical severity with high impact on confidentiality, integrity, and availability. Systems exposing OpenSSH to the network and running vulnerable versions are at risk until patched.

Official patches are available from Linux distributions including Red Hat. Users should apply updates as soon as they are released. For Red Hat Enterprise Linux 9 and its extended update support versions, updated OpenSSH packages have been released and should be installed promptly. Users of other Linux distributions should follow their vendor's guidance and update OpenSSH to patched versions. No additional mitigations beyond applying the official patches are indicated by the vendor advisories.