CVE-2023-38408 Code injection in n/a
Attackers can execute arbitrary code by exploiting an untrusted search path in OpenSSH ssh-agent when agent forwarding is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38408?
CVE-2023-38408 is a critical code injection vulnerability in Fedoraproject Fedora, published on 20 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Weakness: CWE-428
Which versions are affected by CVE-2023-38408?
It affects 2 products.
Linux distribution packages (40)
openssh AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-askpass AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-cavs AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-clients AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-keycat AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-ldap AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
openssh-server AlmaLinux:8 | All versions | 8.0p1-19.el8_8 |
pam_ssh_agent_auth AlmaLinux:8 | All versions | 0.10.3-7.19.el8_8 |
openssh AlmaLinux:9 | All versions | 8.7p1-30.el9_2 |
openssh-askpass AlmaLinux:9 | All versions | 8.7p1-30.el9_2 |
openssh-clients AlmaLinux:9 | All versions | 8.7p1-30.el9_2 |
openssh-keycat AlmaLinux:9 | All versions | 8.7p1-30.el9_2 |
openssh-server AlmaLinux:9 | All versions | 8.7p1-30.el9_2 |
pam_ssh_agent_auth AlmaLinux:9 | All versions | 0.10.4-5.30.el9_2 |
openssh Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-askpass Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-cavs Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-clients Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-keycat Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-ldap Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-server Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
openssh-server-sysvinit Red Hat:enterprise_linux:7::client | All versions | 0:7.4p1-23.el7_9 |
pam_ssh_agent_auth Red Hat:enterprise_linux:7::client | All versions | 0:0.10.3-2.23.el7_9 |
openssh-askpass Red Hat:enterprise_linux:7::computenode | All versions | 0:7.4p1-23.el7_9 |
openssh-cavs Red Hat:enterprise_linux:7::computenode | All versions | 0:7.4p1-23.el7_9 |
openssh-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:7.4p1-23.el7_9 |
openssh-ldap Red Hat:enterprise_linux:7::computenode | All versions | 0:7.4p1-23.el7_9 |
openssh-server-sysvinit Red Hat:enterprise_linux:7::computenode | All versions | 0:7.4p1-23.el7_9 |
pam_ssh_agent_auth Red Hat:enterprise_linux:7::computenode | All versions | 0:0.10.3-2.23.el7_9 |
openssh Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-askpass Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-cavs Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-clients Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-keycat Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-ldap Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-server Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
openssh-server-sysvinit Red Hat:enterprise_linux:7::server | All versions | 0:7.4p1-23.el7_9 |
pam_ssh_agent_auth Red Hat:enterprise_linux:7::server | All versions | 0:0.10.3-2.23.el7_9 |
Products include Fedoraproject Fedora, OpenSSH.
How do I fix CVE-2023-38408?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-38408 being exploited?
There is no known exploitation of CVE-2023-38408 in the wild and no public exploit code.
Public exploit code: 10 proofs of concept on GitHub.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as ALPINE-CVE-2023-38408, ALSA-2023:4412, ALSA-2023:4419, AZL-27651, CLSA-2023-1691576279, CLSA-2023-1691576392 and 30 more.