Homepage

Race Condition The advisory has been revoked - it doesn't affect any version of package pam_ssh_agent_auth  (opens in a new tab)

Threat Intelligence

EPSS
27.94% (98th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-PAMSSHAGENTAUTH-10244294
  • published24 May 2025
  • disclosed8 Jul 2024
Report a new vulnerability Found a mistake?

Introduced: 8 Jul 2024

CVE-2024-6409  (opens in a new tab)
CWE-364  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam_ssh_agent_auth package and not the pam_ssh_agent_auth package as distributed by RHEL.

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

References