Broadcom VMware Cloud Foundation Division response to CVE-2024-6387 - OpenSSH signal handler race condition vulnerability
Article ID: 371126
Updated On:
Products
Issue/Introduction
On Monday July 1st, 2024 details were published on CVE-2024-6387 - a signal handler race condition vulnerability in OpenSSH. The Broadcom Product Security and Incident Response Team (PSIRT) - VMware Cloud Foundation Division (VCFD) has evaluated this vulnerability and its impact on VMware Cloud Foundation products.
Evaluation Details
- Broadcom PSIRT - VCFD has evaluated the vulnerability to be in the Important/High severity range with a CVSSv3.1 base score of 8.1 (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- The vulnerability has only been demonstrated to be exploitable on some 32-bit Linux operating systems in a controlled environment.
- The vulnerability has not been demonstrated on any 64-bit operating system at the time of this publication.
- Currently supported VMware Cloud Foundation product releases are 64-bit.
- OpenSSH versions starting with 8.5p1 are impacted by this vulnerability.
Product Impact (In-Progress)
Not Impacted (does not ship with vulnerable versions of OpenSSH):
- vCenter Server 7.x
- Aria Operations 8.12.x
- Aria Operations 8.10.x
- Aria Operations for Logs 8.12.x
- Aria Operations for Networks 6.13.x
- Aria Operations for Networks 6.14.x
- Aria Lifecycle 8.18
- NSX 4.x
- NSX-T Datacenter 3.x
- VCF SDDC Manager 5.0.x
- VCF SDDC Manager 4.x
- VMware Cloud Director 10.5.x
- VMware Cloud Director 10.4.x
- VMware Cloud Director 10.6.1.2
- VMware Identity Manager 3.3.x
- VMware TKrs 1.26.13
- VMware TKrs 1.27.11 (Photon)
- VMware TKrs 1.30.1 and above
- VMware vCloud Usage Meter 4.7.x
- VMware Cloud Provider Lifecycle Manager 1.6.x
- VMware Cloud Provider Lifecycle Manager 1.5.x
- VMware Cloud Provider Lifecycle Manager 1.4.x
- VMware HCX Interconnect Appliance (HCX-IX) 4.9.1
- VMware HCX Network Extension Appliance (IX-BE) 4.9.1
- VMware HCX WAN Optimization Appliance (WAN-OPT) 4.9.1
- VMware HCX Sentinel Data Receiver Appliance (SDR) 4.9.1
- VMware HCX Sentinel Gateway Appliance (SGW) 4.9.1
- Any / All VCF 9.x components not explicitly indicated in the next list immediately below.
VCF Components that contain the same OpenSSH version number listed in the CVE but that are not impacted by the vulnerability since it applies only to 32-bit implementations that VCF does not deploy or use.
- ESXi 8.x
- ESXi 7.x
- vCenter Server 8.x
- Aria Operations 8.18.x
- Aria Operations 8.17.x
- Aria Operations 8.16.x
- Aria Operations 8.14.x
- Aria Operations for Logs 8.18.x
- Aria Operations for Logs 8.16.x
- Aria Operations for Logs 8.14.x
- Aria Automation 8.18.x
- Aria Automation 8.17.x
- Aria Automation 8.16.x
- Aria Automation Orchestrator 8.18.x
- Aria Automation Orchestrator 8.17.x
- Aria Automation Orchestrator 8.16.x
- VCF SDDC Manager 5.2.x
- VCF SDDC Manager 5.1.x
- VMware TKrs 1.29.4 (Photon & Ubuntu)
- VMware TKrs 1.28.8 (Photon & Ubuntu)
- VMware TKrs 1.27.11 (Ubuntu)
- VMware Site Recovery Manager 9.x
- VMware Site Recovery Manager 8.8.x
- VMware vSphere Replication 9.x
- VMware vSphere Replication 8.8.x
- VMware vCloud Usage Meter 4.8.x
- VMware Cloud Provider Lifecycle Manager 1.7.x
- VMware HCX Manager 4.9.1
- VMware NSX 9.0
- VCF Operations for Networks 9.0
- VCF Supervisor Services 9.0
Impacted (ship vulnerable versions of OpenSSH and are 32-bit)
- None
Resolution
Workarounds
The VMware Cloud Foundation Division continues to recommend that SSH should remain disabled (disabled by default) in production environments. Please see product-specific documentation for details on how to disable SSH if it has been enabled. Alternative workarounds are not recommended and may have functional impacts on a product if implemented without published instructions. If additional workarounds are tested and approved they will be mentioned in the 'Product Impact' section above.
Resolution
VCF components exclusively use 64-bit OpenSSH libraries. Since CVE-2024-6387 only affects 32-bit OpenSSH implementations, VCF is not vulnerable. While security scanners may flag VCF components based on matching OpenSSH version numbers, but ignoring 64-bit vs. 32-bit details, these findings can be safely dismissed as Not Applicable / No Impact because VCF does not deploy or use the vulnerable 32-bit libraries.
Note: Disabling SSH on VMware SDDC Manager will affect the following:
- Rotation of the backup user account password on the SDDC Manager.
- Backup and restore operations on the SDDC Manager.
Additional Information
Refer the table below for Product name and current status of the Vulnerability Impact.
Date of Validation | Product Name | Vulnerability Status | Fixed version |
| 07/02/2024 | VMware Aria Operations for Logs | Not Impacted | N/A |
| 07/02/2024 | VCF SDDC Manager | Not Impacted | N/A |
| 05/12/2025 | VMware Cloud Director | Fixed | 10.6.1.2 NOTE: openssh is updated to 8.9p1-11 and no longer contains vulnerable version |
| 07/02/2024 | NSX & NSX-T Datacenter | Not Impacted | N/A |
| 07/02/2024 | VMware Identity Manager | Not Impacted | N/A |
| 07/03/2024 | VMware Aria Automation | Not Impacted | N/A |
| 07/03/2024 | VMware Automation Orchestrator | Not Impacted | N/A |
| 07/03/2024 | VMware TKrs | Not Impacted | N/A |
| 07/04/2024 | VMware Cloud Provider Lifecycle Manager | Not Impacted | N/A |
| 07/04/2024 | Usage Meter
| Not Impacted | N/A |
| 07/04/2024 | VMware Site Recover Manager
| Not Impacted | N/A |
| 07/04/2024 | VMware vSphere Replication
| Not Impacted | N/A |
| 07/05/2024 | VMware Cloud Provider Lifecycle Manager | Not Impacted | N/A |
| 07/08/2024 | VMware HCX | Not Impacted | N/A |
| 09/30/2024 | ESXi 8.0 U3 | Fixed | ESXi 8.0U3b |
| 10/04/2024 | vCenter Server 8.0 U3 | Fixed | vCenter Server 8.0 U3b NOTE - openSSH is updated to 8.9p1-8 and no longer contains vulnerable version |
| 10/25/2024 | VM TKRs | Fixed | VM TKRs version 1.30.1 |
| 02/20/2025 | Aria Suite Lifecycle | Not Impacted | Not impacted list as its based on Photon v3.0. This CVE affects openssh from (including) 8.6 Up to (excluding) 9.8 LCM 8.18 is on 7.8p1 in Ph3 |
| 8/8/2024 | Aria operations | Fixed | Aria operations 8.18 HF1 no longer contains the vulnerable openssh version. |
| 05/20/2025 | ESXi 7.0 U3 | Fixed | ESXi 7.0 U3v VMware ESXi 7.0 Update 3v Release Notes TechDoc Page |
| 06/26/2025 | VMware Aria Automation (vRA) 8.18.1 | Not Impacted | N/A |
| 08/18/2025 | Aria Operations for Networks 6.14.x
| Not Impacted | N/A |
Broadcom VMware Cloud Foundation Division の CVE-2024-6387 に対する対応 - OpenSSH シグナル ハンドラー競合状態の脆弱性
Feedback
