CVE-2024-6387: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
value: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
CWE description: The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CVSS v3 base score: 8.1
Published: 2024-07-01T13:15Z
Repository: https://github.com/openela-main/openssh
Language: Other
Files changed: .openssh.metadata, SOURCES/openssh-9.8p1-upstream-cve-2024-6387.patch, SPECS/openssh.spec
Commit date: 2024-07-03 21:05:55 +0000
Commit message: import openssh-8.7p1-38.el9_4.1
Diff: diff --git a/.openssh.metadata b/.openssh.metadata
index ac11cb6..2dc0a63 100644
--- a/.openssh.metadata
+++ b/.openssh.metadata
@@ -1,4 +1,4 @@
+9d440de6627940c09eadc342cc7d8bc9823654fd1a2be11c4f5820dd073054e0 SOURCES/pam_ssh_agent_auth-0.10.4.tar.gz
 b07d34756be72d4e294c05a91590355b68bbf3c3b466ea88d21aae168e97c7dc SOURCES/sshd-keygen.target
 7ca34b8bb24ae9e50f33792b7091b3841d7e1b440ff57bc9fabddf01e2ed1e24 SOURCES/openssh-8.7p1.tar.gz
 bb18c454a3e5d3738cb26a1c89e17c467d7a59529ec92251b26461ae04771eba SOURCES/openssh-8.7p1.tar.gz.asc
-9d440de6627940c09eadc342cc7d8bc9823654fd1a2be11c4f5820dd073054e0 SOURCES/pam_ssh_agent_auth-0.10.4.tar.gz
diff --git a/SOURCES/openssh-9.8p1-upstream-cve-2024-6387.patch b/SOURCES/openssh-9.8p1-upstream-cve-2024-6387.patch
new file mode 100644
index 0000000..754d279
--- /dev/null
+++ b/SOURCES/openssh-9.8p1-upstream-cve-2024-6387.patch
@@ -0,0 +1,18 @@
+diff -up openssh-8.7p1/log.c.xxx openssh-8.7p1/log.c
+--- openssh-8.7p1/log.c.xxx	2024-06-28 11:02:43.949912398 +0200
++++ openssh-8.7p1/log.c	2024-06-28 11:02:58.652297885 +0200
+@@ -455,12 +455,14 @@ void
+ sshsigdie(const char *file, const char *func, int line, int showfunc,
+     LogLevel level, const char *suffix, const char *fmt, ...)
+ {
++#if 0
+ 	va_list args;
+ 
+ 	va_start(args, fmt);
+ 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
+ 	    suffix, fmt, args);
+ 	va_end(args);
++#endif
+ 	_exit(1);
+ }
+ 
diff --git a/SPECS/openssh.spec b/SPECS/openssh.spec
index 8a7a38e..9c467db 100644
--- a/SPECS/openssh.spec
+++ b/SPECS/openssh.spec
@@ -52,11 +52,11 @@
 %global pam_ssh_agent_rel 5
 
 Summary: An open source implementation of SSH protocol version 2
 Name: openssh
 Version: %{openssh_ver}
-Release: %{openssh_rel}%{?dist}
+Release: %{openssh_rel}%{?dist}.1
 URL: http://www.openssh.com/portable.html
 #URL1: https://github.com/jbeverly/pam_ssh_agent_auth/
 Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
 Source1: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz.asc
 Source2: sshd.pam
@@ -286,10 +286,11 @@ Patch1016: openssh-9.3p1-openssl-compat.patch
 Patch1017: openssh-9.4p2-limit-delay.patch
 #upstream commit 1edb00c58f8a6875fad6a497aa2bacf37f9e6cd5
 Patch1018: openssh-9.6p1-CVE-2023-48795.patch
 #upstream commit 7ef3787c84b6b524501211b11a26c742f829af1a
 Patch1019: openssh-9.6p1-CVE-2023-51385.patch
+Patch1020: openssh-9.8p1-upstream-cve-2024-6387.patch
 
 License: BSD
 Requires: /sbin/nologin
 
 %if ! %{no_gnome_askpass}
@@ -360,11 +361,11 @@ Summary: OpenSSH SK driver for test purposes
 Requires: openssh = %{version}-%{release}
 
 %package -n pam_ssh_agent_auth
 Summary: PAM module for authentication with ssh-agent
 Version: %{pam_ssh_agent_ver}
-Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}
+Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}.1
 License: BSD
 
 %description
 SSH (Secure SHell) is a program for logging into and executing
 commands on a remote machine. SSH is intended to replace rlogin and
@@ -509,10 +510,11 @@ popd
 %patch1015 -p1 -b .cve-2023-38408
 %patch1016 -p1 -b .openssl3compat
 %patch1017 -p1 -b .limitdelay
 %patch1018 -p1 -b .cve-2023-48795
 %patch1019 -p1 -b .cve-2023-51385
+%patch1020 -p1 -b .cve-2024-6387
 
 autoreconf
 pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
 autoreconf
 popd
@@ -796,10 +798,14 @@ test -f %{sysconfig_anaconda} && \
 %attr(0755,root,root) %{_libdir}/security/pam_ssh_agent_auth.so
 %attr(0644,root,root) %{_mandir}/man8/pam_ssh_agent_auth.8*
 %endif
 
 %changelog
+* Fri Jun 28 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.1
+- Possible remote code execution due to a race condition (CVE-2024-6387)
+  Resolves: RHEL-45347
+
 * Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38
 - Fix Terrapin attack
   Resolves: CVE-2023-48795
 
 * Fri Jan 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-37

Vulnerable code: 9d440de6627940c09eadc342cc7d8bc9823654fd1a2be11c4f5820dd073054e0 SOURCES/pam_ssh_agent_auth-0.10.4.tar.gz
Release: %{openssh_rel}%{?dist}
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}
Fixed code: 9d440de6627940c09eadc342cc7d8bc9823654fd1a2be11c4f5820dd073054e0 SOURCES/pam_ssh_agent_auth-0.10.4.tar.gz
diff -up openssh-8.7p1/log.c.xxx openssh-8.7p1/log.c
--- openssh-8.7p1/log.c.xxx	2024-06-28 11:02:43.949912398 +0200
@@ -455,12 +455,14 @@ void
 sshsigdie(const char *file, const char *func, int line, int showfunc,
     LogLevel level, const char *suffix, const char *fmt, ...)
 {
+#if 0
 	va_list args;
 
 	va_start(args, fmt);
 	sshlogv(file, func, line, showfunc, SYSLOG_LEVEL_FATAL,
 	    suffix, fmt, args);
 	va_end(args);
+#endif
 	_exit(1);
 }
 
Release: %{openssh_rel}%{?dist}.1
Patch1020: openssh-9.8p1-upstream-cve-2024-6387.patch
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}.1
%patch1020 -p1 -b .cve-2024-6387
* Fri Jun 28 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-38.1
- Possible remote code execution due to a race condition (CVE-2024-6387)
  Resolves: RHEL-45347