CVE-2023-38408

Deeper analysis

The vulnerability is an insufficiently trustworthy search path in the PKCS#11 feature of ssh-agent within OpenSSH versions prior to 9.3p2. This stems from an incomplete remediation of CVE-2016-10009 and allows code in directories such as /usr/lib to be loaded into the agent even when that code cannot be assumed safe. The issue is tracked as CWE-428 and carries a CVSS 3.1 score of 9.8.

An attacker who can arrange for a victim’s ssh-agent to be forwarded to a system under their control can supply a malicious PKCS#11 module that ssh-agent will load, resulting in remote code execution on the victim’s host with the privileges of the agent process. No authentication or user interaction is required once the agent forwarding occurs.

Upstream advisories and the OpenSSH 9.3p2 release notes direct users to upgrade immediately; the fix restricts the search path used for PKCS#11 providers when an agent is forwarded. Public exploit code has been posted, and the EPSS score has reached a peak of 0.6999 with a current value of 0.6435, indicating sustained exploitation interest after disclosure.