CRITICAL 9.8 Microsoft PoC
CVE-2023-38408
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Microsoft Security Update 2023-Jul: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Affected Products
- cm1 openssh 8.9p1-3 on CBL Mariner 1.0
- cbl2 openssh 8.9p1-1 on CBL Mariner 2.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38408
- https://nvd.nist.gov/vuln/detail/CVE-2023-38408
This critical severity vulnerability with a CVSS score of 9.8 was published on 2023-07-11 via Microsoft. 🚨 A public proof-of-concept exploit is available on GitHub. EPSS score: 79.7% (top 0% of all CVEs by exploitation probability). Affected: cm1 openssh 8.9p1-3 on CBL Mariner 1.0, cbl2 openssh 8.9p1-1 on CBL Mariner 2.0.
Risk Timeline
CVE Disclosed2023-07-11 · 1207 days ago
Public PoC Exploit AvailableWeaponised proof-of-concept code is publicly accessible
Remediation Resources
Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38408NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2023-38408Related Vulnerabilities
| CVE | Title | Severity | CVSS |
|---|---|---|---|
| CVE-2023-38427 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu. | CRITICAL | 9.8 |
| CVE-2023-38429 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/connection.c | CRITICAL | 9.8 |
| CVE-2023-38426 | An issue was discovered in the Linux kernel before 6.3.4. ksmbd has an out-of-bo | CRITICAL | 9.1 |
| CVE-2023-38428 | An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in | CRITICAL | 9.1 |
| CVE-2023-38430 | An issue was discovered in the Linux kernel before 6.3.9. ksmbd does not validat | CRITICAL | 9.1 |
| CVE-2023-38431 | An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/connecti | CRITICAL | 9.1 |
vulnfeed aggregates 18441 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.