CVE-2024-39894

HIGH

OpenSSH 9.5-9.7 - Time-of-check Time-of-use Race Condition in ObscureKeystrokeTiming

Title source: llm

Description

OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.

References (12)

Core 12

Core References

Various Sources

https://crzphil.github.io/posts/ssh-obfuscation-bypass/

Various Sources

https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-July/000158.html

Various Sources

https://news.ycombinator.com/item?id=41508530

Various Sources

https://www.openssh.com/txt/release-9.8

Mailing List

https://www.openwall.com/lists/oss-security/2024/07/02/1

Mailing List

http://seclists.org/fulldisclosure/2024/Sep/33

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240712-0004/

Vendor Advisory

https://www.freebsd.org/security/advisories/FreeBSD-SA-25:01.openssh.asc

Mailing List mailing-list

http://www.openwall.com/lists/oss-security/2024/07/03/6

Mailing List mailing-list

http://www.openwall.com/lists/oss-security/2024/07/23/4

Mailing List mailing-list

http://www.openwall.com/lists/oss-security/2024/07/23/6

Mailing List mailing-list

http://www.openwall.com/lists/oss-security/2024/07/28/3

Scores

CVSS v3 7.5

EPSS 0.0148

EPSS Percentile 70.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-367

Status published

Published Jul 02, 2024

Tracked Since Feb 18, 2026