A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1721929402 advisory.

  - A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
    (CVE-2024-6409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1419 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.6. It addresses 32 CVEs:
    CVE-2025-26465, CVE-2016-1908, CVE-2014-2532, CVE-2026-35388, CVE-2023-48795, and 27 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0470 advisory.

    This advisory aggregates security fixes for the openssh SRPM in CIQ LTS 9.2. It addresses 21 CVEs:
    CVE-2006-4924, CVE-2023-51385, CVE-2016-6210, CVE-2016-1908, CVE-2023-48795, and 16 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_4457 advisory.

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Rocky Linux     9 (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8554:06 advisory.

    * openssh: Possible remote code execution due to a race condition in signal handling affecting MIRACLE     LINUX 9 (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd     server.(CVE-2024-6409)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd     server.(CVE-2024-6409)

Tenable has extracted the preceding description block directly from the EulerOS openssh security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4910 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4716 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-651 advisory.

    A signal handler race condition vulnerability was found in OpenSSH's server (sshd), where a client does     not authenticate within LoginGraceTime seconds (120 by default, 600 in old OpenSSH versions), then sshd's     SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are     not async-signal-safe, for example, syslog(). This issue leaves it vulnerable to a signal handler race     condition on the cleanup_exit() function, which introduces the same vulnerability as CVE-2024-6387 in the     unprivileged child of the SSHD server. (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-43.el9 build changelog.

  - A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a     remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called     asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for     example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be     able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.
    (CVE-2024-6409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4457 advisory.

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Rocky Linux     9 (CVE-2024-6409)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4457 advisory.

    OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating     systems. It includes the core files necessary for both the OpenSSH client and server.

    Security Fix(es):

    * openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat     Enterprise Linux 9 (CVE-2024-6409)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4457 advisory.

    [8.7p1-38.0.2.4]
    - Possible remote code execution due to a race condition (CVE-2024-6409)       Resolves: RHEL-45741

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
361598	AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.2:CLSA-2024:1721929402)	Nessus	Alma Linux Local Security Checks	Local	high
356390	Rocky Linux 9.6 [CIQ] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc Multiple Vulnerabilities (ciqsa-2026_1419)	Nessus	Rocky Linux Local Security Checks	Local	critical
354271	Rocky Linux 9.2 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0470)	Nessus	Rocky Linux Local Security Checks	Local	critical
353794	Rocky Linux 9 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc (crlsa-2024_4457)	Nessus	Rocky Linux Local Security Checks	Local	high
293348	MiracleLinux 9 : openssh-8.7p1-38.el9_4.4 (AXSA:2024-8554:06)	Nessus	Miracle Linux Local Security Checks	Local	high
504180	Siemens SIMATIC S7-1500 Signal Handler Race Condition (CVE-2024-6409)	Tenable OT Security	Tenable.ot	Remote	high
209768	EulerOS Virtualization 2.12.0 : openssh (EulerOS-SA-2024-2774)	Nessus	Huawei Local Security Checks	Local	high
209761	EulerOS Virtualization 2.12.1 : openssh (EulerOS-SA-2024-2756)	Nessus	Huawei Local Security Checks	Local	high
208407	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2536)	Nessus	Huawei Local Security Checks	Local	high
208389	EulerOS 2.0 SP12 : openssh (EulerOS-SA-2024-2511)	Nessus	Huawei Local Security Checks	Local	high
204862	RHEL 9 : openssh (RHSA-2024:4910)	Nessus	Red Hat Local Security Checks	Local	high
203133	RHEL 9 : openssh (RHSA-2024:4716)	Nessus	Red Hat Local Security Checks	Local	high
202916	Amazon Linux 2023 : openssh, openssh-clients, openssh-keycat (ALAS2023-2024-651)	Nessus	Amazon Linux Local Security Checks	Local	high
202392	CentOS 9 : openssh-8.7p1-43.el9	Nessus	CentOS Local Security Checks	Local	high
202382	Rocky Linux 9 : openssh (RLSA-2024:4457)	Nessus	Rocky Linux Local Security Checks	Local	high
202158	RHEL 9 : openssh (RHSA-2024:4457)	Nessus	Red Hat Local Security Checks	Local	high
202153	Oracle Linux 9 : openssh (ELSA-2024-4457)	Nessus	Oracle Linux Local Security Checks	Local	high

Detections

Analytics

CVE-2024-6409

high

Tenable Plugins

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high