CVE-2023-38408

high-risk

Published 2023-07-20

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Do I need to act?

64.4% chance of exploitation in next 30 days

EPSS score — higher than 36% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (5)

Openssh

Fedora

Affected Vendors

Openbsd Fedoraproject

References (40)

Exploit http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-C...

Exploit http://www.openwall.com/lists/oss-security/2023/07/20/1

Mailing List http://www.openwall.com/lists/oss-security/2023/07/20/2

http://www.openwall.com/lists/oss-security/2023/09/22/11

http://www.openwall.com/lists/oss-security/2023/09/22/9

Third Party Advisory https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-3840...

Patch https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8

Patch https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d

Patch https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca

https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Issue Tracking https://news.ycombinator.com/item?id=36790196

Third Party Advisory https://security.gentoo.org/glsa/202307-01

https://security.netapp.com/advisory/ntap-20230803-0010/

https://support.apple.com/kb/HT213940

Vendor Advisory https://www.openssh.com/security.html

Release Notes https://www.openssh.com/txt/release-9.3p2

Exploit https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent...

https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-c...

and 20 more references

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 19/34 · Moderate

Exposure 12/34 · Low