CVE-2023-51384

MEDIUM

OpenSSH <9.6 - Privilege Escalation

Title source: llm

Description

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS#11-hosted private keys, these constraints are only applied to the first key, even if a PKCS#11 token returns multiple keys.

References (7)

[Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2024/Mar/21

[Patch, Third Party Advisory] https://github.com/openssh/openssh-portable/commit/881d9c6af9da4257c69c327c4e2f1508b2fa754b

View Patch ZIP pw:eip

[Third Party Advisory] https://security.netapp.com/advisory/ntap-20240105-0005/

[Third Party Advisory] https://support.apple.com/kb/HT214084

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5586

[Release Notes] https://www.openssh.com/txt/release-9.6

[Mailing List, Release Notes] https://www.openwall.com/lists/oss-security/2023/12/18/2

Scores

CVSS v3 5.5

EPSS 0.0004

EPSS Percentile 13.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

Status published

Affected Products (3)

openbsd/openssh < 9.6

debian/debian_linux

debian/debian_linux

Timeline

Published Dec 18, 2023

Tracked Since Feb 18, 2026