CVE-2024-7589

A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.

• CWE-362
• CWE-364

• https://security.freebsd.org/advisories/FreeBSD-SA-24:08.openssh.ascVendor Advisory
• https://www.cve.org/CVERecord?id=CVE-2006-5051Not Applicable
• https://www.cve.org/CVERecord?id=CVE-2024-6387Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240816-0002/

Published

Aug 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-7583A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-7584A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-7585A vulnerability has been found in Tenda i22 1.0.0.3(4687) an…9.8
• CVE-2024-7586An issue was discovered in GitLab EE affecting all versions …7.5
• CVE-2024-7587Incorrect Default Permissions vulnerability in GenBroker32, …7.8
• CVE-2024-7588The Gutenberg Blocks, Page Builder – ComboBlocks plugin for …6.4
• CVE-2024-7590Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-7591Improper Input Validation vulnerability in Progress LoadMast…7.2
• CVE-2024-7592There is a LOW severity vulnerability affecting CPython, spe…7.5
• CVE-2024-7593Incorrect implementation of an authentication algorithm in I…9.8
• CVE-2024-7594Vault’s SSH secrets engine did not require the valid_princip…8.8
• CVE-2024-7595GRE and GRE6 Protocols (RFC2784) do not validate or verify t…6.5