CVE-2024-6409

A race condition vulnerability was discovered in how signals are handled by
OpenSSH’s server (sshd). If a remote attacker does not authenticate within
a set time period, then sshd’s SIGALRM handler is called asynchronously.
However, this signal handler calls various functions that are not
async-signal-safe, for example, syslog(). As a consequence of a successful
attack, in the worst case scenario, an attacker may be able to perform a
remote code execution (RCE) as an unprivileged user running the sshd
server.

Notes