CVE-2023-38408

Published Jul 20, 2023

Last updated 2 years ago

CVSS critical 9.8

Ubuntu

SSH

Port (22)

Overview

Description: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Source: cve@mitre.org
NVD status: Modified

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-428
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-428

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BF546253-FE80-4416-A138-D79D7288229F",
            "versionEndExcluding": "9.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.3:-:*:*:*:*:*:*",
            "matchCriteriaId": "031E80CD-A7CF-447A-AEEF-EB97EB99A762",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openbsd:openssh:9.3:p1:*:*:*:*:*:*",
            "matchCriteriaId": "97FEC052-52ED-464F-AF19-3621775292D6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
            "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
            "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References