CVE-2024-6409VulnerabilityPublished 10 Jul 2024Updated 11 Oct 2026

SUSE · security update for openssh

Affects SUSESource GCVE Database

Not known to be exploited · 27% EPSS : upgrade to 9.0.3 when convenient.

Data as of 25 Oct 2026, 19:02 UTC

Severity

Low

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 27.9% chance of exploitation in 30 days – higher than 98% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 9.0.3

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Jul 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade SUSE to 9.0.3.

Affected software

Product	Affected	Fixed in
SUSE Product Security Team SUSE	Affected >=9.0 <9.0.3	Fixed in 9.0.3

AI-suggested

Red Hat has released official security updates that address this vulnerability for Red Hat Enterprise Linux 9 and related products. Users should apply these updates promptly. For detailed update instructions, refer to Red Hat's advisory and knowledge base article at https://access.redhat.com/errata/RHSA-2024:4457 and https://access.redhat.com/articles/11258. Since an official fix is available, applying the vendor-provided patches is the recommended mitigation.

Description

CVE-2024-6409 is a race condition vulnerability in OpenSSH server's signal handling that may allow remote code execution by an unprivileged user. The issue occurs when the sshd process handles a SIGALRM signal asynchronously during authentication timeout, invoking non-async-signal-safe functions like syslog(). This affects OpenSSH versions from 9.0 up to but not including 9.0.3. Red Hat has released security updates addressing this flaw for Red Hat Enterprise Linux 9 and related products. No known exploits are reported in the wild.

Impact

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the sshd server with unprivileged user rights. This could lead to unauthorized control or disruption of the affected system. However, no known exploits are currently reported in the wild.

Summary

CVE-2024-6409 is a race condition in OpenSSH's sshd signal handling triggered by asynchronous invocation of the SIGALRM handler when a remote attacker fails authentication within a set time. The handler calls functions such as syslog() that are not safe to use in asynchronous signal contexts, leading to a race condition that could be exploited for remote code execution with the privileges of the sshd process. This vulnerability affects OpenSSH versions >=9.0 and <9.0.3. Red Hat has issued security advisories and patches for Red Hat Enterprise Linux 9 and OpenShift Container Platform 4.16.4 to remediate this issue. The CVSS v3.1 base score is 7.0, indicating high severity, though Red Hat rates the impact as moderate. No active exploitation has been reported.

CWE-364Signal Handler Race Condition (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
The product uses a signal handler that introduces a race condition.
Requirements · Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Architecture and Design
Design signal handlers to only set flags, rather than perform complex functionality. These flags can then be checked and acted upon within the main program loop.
Implementation
Only use reentrant functions within signal handlers. Also, use validation to ensure that state is consistent while performing asynchronous actions that affect the state of execution.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Oct 2026, 22:34 UTC

WeaknessesCWE-364

Technical details

References

Community reviews

Related threats