Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-7589 is a high-severity Race Condition (CWE-362) vulnerability in Freebsd Freebsd. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 21% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A signal handler in the sshd(8) daemon on FreeBSD can invoke a logging function that is not async-signal-safe. The handler triggers when a client fails to authenticate within the LoginGraceTime window (120 seconds by default) and executes inside the privileged, unsandboxed sshd process running with full root privileges. The flaw stems from FreeBSD's integration of blacklistd into OpenSSH and is described as a distinct instance of the earlier issue tracked in CVE-2024-6387.
An unauthenticated remote attacker who can reach the SSH service may deliberately trigger the signal handler and attempt to exploit the resulting race condition. Successful exploitation yields remote code execution with root privileges on the target system. The attack requires precise timing and is rated high severity under CVSS 8.1.
FreeBSD advisory SA-24:08.openssh addresses the issue and is referenced alongside related OpenSSH CVEs and a NetApp security bulletin. System administrators are expected to apply the corresponding FreeBSD patch or update to eliminate the unsafe logging call from the signal handler.
EPSS for the vulnerability rose from a low baseline to a peak of 0.2196 (current value 0.1741), indicating that exploitation interest increased after disclosure. No reports of in-the-wild exploitation appear in the supplied references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-48485
Vulnerability Data
A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of…
more
the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges. This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD. As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.2V10.4.5V15.1.3V15.4.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including concurrency and fuzz testing) can discover signal-handler race conditions before deployment.
Engineering principles such as least privilege, complete mediation, and avoidance of shared mutable state in handlers directly reduce introduction of signal-handler race conditions.
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.
Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.
Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Change management reduces introduction of concurrency bugs during updates, yet does not address the weakness itself.