Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
CVE: CVE-2024-6409
Component: openssh
CWE: CWE-364
Severity: Moderate
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2024-07-08T17:45:07+00:00

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Statement: Red Hat rates the severity of this flaw as Moderate for both Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform (OCP). While there are many similarities to CVE-2024-6387, the important difference is that any possible remote code execution is limited to an unprivileged child of the SSHD server. This additional restriction on access reduces the overall security impact.

This vulnerability only affects the versions of OpenSSH shipped with Red Hat Enterprise Linux 9. Upstream versions of sshd are not impacted by this flaw.

The affected versions of OCP are 4.13, 4.14, 4.15, and 4.16 while 4.12 and earlier versions of OCP are not affected.

Remediation:
For OpenShift Container Platform 4.13 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.13/release_notes/ocp-4-13-release-notes.html
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:7235b8e139da4ba4c17c2b4b9864c05c93c5f55f7c2f561e7f9796c7e6589917

      (For s390x architecture)
      The image digest is sha256:04865553b69831321134ca4e61be8ad02548ccfd41a2941c09bf357d5120dbde

      (For ppc64le architecture)
      The image digest is sha256:471fc8ffaa8d14e5aff88b91dcf378291aec41ab524aa88a1562f4767bf57b62

      (For aarch64 architecture)
      The image digest is sha256:83ddfc54da02ab4f523d181c7e9eeb24b3deef3bf6da3052e6db894f246c7a99

All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.13/updating/updating-cluster-cli.html
For OpenShift Container Platform 4.14 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:d703e6615b85a6f94fb3f3e490f2eb4514412bc018ecfe967f57f4221116a718

      (For s390x architecture)
      The image digest is sha256:5974477b97dd1b519790c6eaf644c8a4a00fe4347eb18551a94754075ca690dd

      (For ppc64le architecture)
      The image digest is sha256:43013ace5c68f0ba4dd2b648df54e1bbd8a4cd4ed301cd252d2b403c0ca9180f

      (For aarch64 architecture)
      The image digest is sha256:1eb0e157f57bebcfa8feed480479e540e60d93c4f93c951870002dbacd42c639

All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.15/release_notes/ocp-4-15-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:81874cf1470a55c07baa9ffa0722efd3819c8ed54c15244713d3c20b231eb516

      (For s390x architecture)
      The image digest is sha256:8ce860bf1a7abb3ac033daa8e0e29b147b694fadf04ad7fcc6476aa66f40fb48

      (For ppc64le architecture)
      The image digest is sha256:294a17de9476ae1d89f0258f196c8825b3b122010ac89846e1e3d8085352b42b

      (For aarch64 architecture)
      The image digest is sha256:8800b38e920e726cecf55edce79e8c94d310d6a96058a34cd4dd666119e74397

All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.15/updating/updating_a_cluster/updating-cluster-cli.html
For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

      https://docs.openshift.com/container-platform/4.16/release_notes/ocp-4-16-release-notes.html

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha values for the release are

      (For x86_64 architecture)
      The image digest is sha256:633d1d36e834a70baf666994ef375b9d1702bd1c54ab46f96c41223af9c2d150

      (For s390x architecture)
      The image digest is sha256:3acd5a5030ccf39daf86d1109c3aa00f1f48d5f62054a37c779e7c62178468ad

      (For ppc64le architecture)
      The image digest is sha256:0d92c8189470fa0031c85e8f77e24d780ab3da4313b6454e88ad3bec909f269b

      (For aarch64 architecture)
      The image digest is sha256:c853f47f5e8f8d8afb943f5a75757b6870c0b8bcf4507a1bbe4ad53e9ef3fdd6

All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.16/updating/updating_a_cluster/updating-cluster-cli.html
The process is identical to CVE-2024-6387, by disabling LoginGraceTime. See that CVE page for additional details.