# MA-1095.072024: MyCERT Advisory - RCE Vulnerability in OpenSSH Linux systems

**Date:** 12 Jul 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1095.072024  
**Advisory ID:** MA-1095.072024

---

**1.0 Introduction**
Recently, a new vulnerability in OpenSSH, identified as CVE-2024-6409, which is a critical vulnerability in OpenSSH, identified as a signal handler race condition in Red Hat Enterprise Linux 9, where a client does not authenticate within LoginGarceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd’s SIGALRM handler is called asynchronously. 
**2.0 Impact**
An exploited vulnerability could lead to a remote code execution (RCE) within the context of the unprivileged user running the SSHD server.
**3.0 Affected Products**
- OpenSSH version 8.7 and 8.8
**4.0 Recommendation**
CyberSecurity Malaysia highly recommends that users of these applications upgrade to the latest version of the affected products. 
Kindly refer to the following URL: <https://security-tracker.debian.org/tracker/CVE-2024-6409>
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web:[https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://cybersecuritynews.com/new-openssh-vulnerability-cve-2024-6409/>
- <https://sig-security.rocky.page/issues/CVE-2024-6409/#mitigation>
- <https://nvd.nist.gov/vuln/detail/CVE-2024-6409>
- <https://www.theregister.com/2024/07/11/openssh_bug_in_rhel_9/>
- <https://vulcan.io/how-to-fix-cve-2024-6409-in-openssh>
- <https://security-tracker.debian.org/tracker/CVE-2024-6409>
- <https://thehackernews.com/2024/07/new-openssh-vulnerability-discovered.html>