CVE-2023-38408

🗓️ 20 Jul 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 37232 Views🌐 WEB

PKCS#11 feature in ssh-agent in OpenSSH has insufficiently trustworthy search path leading to remote code execution

Reporter	Title	Published	Views	Family All 337
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	17 Oct 202413:03	–	githubexploit
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	19 Apr 202520:09	–	githubexploit
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	24 Jan 202609:27	–	githubexploit
GithubExploit	Exploit for Uncontrolled Resource Consumption in Discourse	9 Aug 202319:56	–	githubexploit
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	9 Aug 202319:56	–	githubexploit
GithubExploit	ethical-hacking-portfolio	3 May 202612:41	–	githubexploit
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	9 Nov 202304:34	–	githubexploit
GithubExploit	Exploit for Unquoted Search Path or Element in Openbsd Openssh	21 Jul 202301:53	–	githubexploit
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSH affects IBM Integrated Analytics System (Sailfish)[CVE-2023-38408]	11 Sep 202311:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.6.3 fixes multiple security vulnerabilities	1 Nov 202310:38	–	ibm

NVD

Node

Node

Source	Link
blog	www.blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent
openwall	www.openwall.com/lists/oss-security/2023/07/20/1
vicarius	www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408
github	www.github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d
security	www.security.netapp.com/advisory/ntap-20230803-0010/
openwall	www.openwall.com/lists/oss-security/2023/07/20/2
packetstormsecurity	www.packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/
qualys	www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
openwall	www.openwall.com/lists/oss-security/2023/09/22/9

Parameter	Position	Path	Description	CWE
SSH_AUTH_SOCK	path	/usr/lib/systemd/boot/efi/linuxx64.elf.stub	OpenSSH ssh-agent PKCS#11 path allows loading a library from /usr/lib via ssh-add; attacker can exploit by loading a malicious PKCS#11 provider.	CWE-428
ssh-add -s /usr/lib/systemd/boot/efi/linuxx64.elf.stub	path	/usr/lib/systemd/boot/efi/linuxx64.elf.stub	OpenSSH ssh-agent PKCS#11 path allows loading a library from /usr/lib via ssh-add; attacker can exploit by loading a malicious PKCS#11 provider.	CWE-428
dlopen/dlclose of libraries on /usr/lib*	path	/usr/lib/x86_64-linux-gnu/librt.so.1	Nodelete libraries loaded via ssh-agent may remain mapped and be used in unintended ways during remote exploitation.	CWE-428
ssh-agent forwarding	path	/usr/lib/x86_64-linux-gnu/librt.so.1	Nodelete libraries loaded via ssh-agent may remain mapped and be used in unintended ways during remote exploitation.	CWE-428
SHELLCODE payload via SSH_AUTH_SOCK	path	/usr/lib/modules	An example directory used to store payloads to be loaded through ssh-agent forwarding in PoC scenarios.	CWE-428
nc -U "$SSH_AUTH_SOCK"	path	/usr/lib/modules	An example directory used to store payloads to be loaded through ssh-agent forwarding in PoC scenarios.	CWE-428

17 Jun 2026 06:10Current

8.3High risk

Vulners AI Score8.3

CVSS 3.19.8

EPSS0.797

SSVC