Paper/Archive/CVE-2023-38408

CVE-2023-38408

Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution…

EPSS 80%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 99.6.996 × 2019.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refnews.ycombinator.com/item?id=36790196 refblog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent refqualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt refgithub.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca refgithub.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 refgithub.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d refopenssh.com/txt/release-9.3p2 refopenssh.com/security.html advisorysecurity.gentoo.org/glsa/202307-01 refopenwall.com/lists/oss-security/2023/07/20/1 refopenwall.com/lists/oss-security/2023/07/20/2 refpacketstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ refsecurity.netapp.com/advisory/ntap-20230803-0010 reflists.debian.org/debian-lts-announce/2023/08/msg00021.html refopenwall.com/lists/oss-security/2023/09/22/9 refopenwall.com/lists/oss-security/2023/09/22/11 refsupport.apple.com/kb/HT213940 refvicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408 refcert-portal.siemens.com/productcert/html/ssa-398330.html