TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Remote code execution in OpenSSH’s forwarded SSH-agent

271 点作者 vitplister将近 2 年前

19 条评论

tptacek将近 2 年前
This is the bug of the year.<p>It&#x27;s well established that if Alice forwards an SSH agent to Bob, Bob can use the SSH agent protocol to make Alice open DLLs, because there&#x27;s an agent protocol command (SSH_AGENTC_ADD_SMARTCARD_KEY) that OpenSSH implements with dlopen: when you ask the agent to access a smart card, OpenSSH dlopen()&#x27;s the library corresponding to the `id` of the device. This is a Jann Horn bug from 2016, and OpenSSH fixed it by whitelisting DLLs to &#x2F;usr&#x2F;lib and directories like it.<p>The Qualys bug builds on Horn&#x27;s bug. When OpenSSH dlopen()&#x27;s the library, it then tries to look up a PKCS#11 entry point function, and, when it doesn&#x27;t find it, it dlclose()&#x27;s the library and returns an error.<p>The issue is that most of the libraries in system library paths were never intended to be opened maliciously, and so they do all sorts of stuff in their constructors and destructors (any function marked `__attribute__((constructor))` or `destructor` is called by dlopen and dlclose respectively). In particular, they register callbacks and signal handlers. Most of these libraries are never expected to dlclose at all, so they tend not to be great about cleaning up. Better still, if you randomly load oddball libraries into random programs, some of them crash, generating SIGBUS and SIGSEGV.<p>So you&#x27;ve got a classic UAF situation here: (1) force Alice to load a library that registers a SIGBUS handler; it won&#x27;t be a PKCS#11 handler so it&#x27;ll get immediately dlclose()&#x27;d, but won&#x27;t clean up the handler. (2) Load another library, which will take over the program text address the signal handler points to. (3) Finally, load a library that SIGBUS&#x27;s. If you manage to get a controlled jump swapped into place in step (2), you win.<p>If you&#x27;re thinking &quot;it&#x27;s pretty unlikely you&#x27;re going to be able to line up a controlled jump at exactly the address previously registered as a signal handler&quot;, you&#x27;re right, but there&#x27;s another quirk of dlclose() they take advantage of: there&#x27;s an ELF flag, NODELETE, that instructs the linker not to unmap a library when it&#x27;s unloaded, and a bunch of standard libraries set it, so you can use those libraries to groom the address space.<p>Finally, because some runtimes require executable stacks, there are standard libraries with an ELF flag that instructs the process to make the stack executable. If you load one of these libraries, and you have a controlled jump, you can write shellcode into the stack like it&#x27;s 1998.<p>To figure out the right sequence of steps, they basically recapitulated the original ROP gadget research idea: they swept all the standard Ubuntu libraries with a fuzzer to find combinations of loads that produced controlled jumps (ie, that died trying to execute stack addresses).<p>A working exploit loads a pattern of &quot;smartcards&quot; that looks like this (all in &#x2F;usr&#x2F;lib):<p><pre><code> syslinux&#x2F;modules&#x2F;efi64&#x2F;gfxboot.c32 (execstack) pulse-15.0+dfsg1&#x2F;modules&#x2F;module-remap-sink.so (groom) x86_64-linux-gnu&#x2F;libgnatcoll_postgres.so.1 (SIGBUS handler) pulse-15.0+dfsg1&#x2F;modules&#x2F;module-http-protocol-unix.so (groom) x86_64-linux-gnu&#x2F;sane&#x2F;libsane-hp.so.1.0.32 (groom) libreoffice&#x2F;program&#x2F;libindex_data.so (groom) x86_64-linux-gnu&#x2F;gstreamer-1.0&#x2F;libgstaudiorate.so (groom) libreoffice&#x2F;program&#x2F;libscriptframe.so (groom) x86_64-linux-gnu&#x2F;libisccc-9.16.15-Ubuntu.so (groom) x86_64-linux-gnu&#x2F;libxkbregistry.so.0.0.0 (groom) debug&#x2F;.build-id&#x2F;15&#x2F;c0bee6bcb06fbf381d0e0e6c52f71e1d1bd694.debug (SIGBUS) </code></pre> The paper goes on to classify like 4 more patterns whereby you can get unexpected control transfers by dlopen() and immediately dlclosing() libraries. The kicker:<p><pre><code> we noticed that one shared library&#x27;s constructor function (which can be invoked by a remote attacker via an ssh-agent forwarding) starts a server thread that listens on a TCP port, and we discovered a remotely exploitable vulnerability (a heap-based buffer overflow) in this server&#x27;s implementation.</code></pre>
评论 #36796888 未加载
评论 #36796539 未加载
评论 #36795944 未加载
评论 #36798205 未加载
评论 #36806206 未加载
评论 #36798367 未加载
评论 #36828161 未加载
sullivanmatt将近 2 年前
This sounds way worse than it is.<p>To be clear, the &quot;remote&quot; part of the code execution is that an attacker controlling your destination server can cause your <i>client</i> to run an attacker-controlled payload, <i>if</i> the client is forwarding their credentials (`ssh -A`). Most people don&#x27;t tend to make connections to arbitrary SSH hosts, and certainly they don&#x27;t do it while forwarding their credentials along.<p>It&#x27;s a neat attack, and I applaud the Qualys team on their find, but this is not any sort of emergency situation for 99.99% of systems.
评论 #36794497 未加载
评论 #36792352 未加载
评论 #36791957 未加载
评论 #36797014 未加载
评论 #36791776 未加载
评论 #36791501 未加载
评论 #36798170 未加载
评论 #36793804 未加载
aidenn0将近 2 年前
Even without this announcement, friends don&#x27;t let friends forward their ssh agent. It essentially grants that machine access to your private keys. A RCE vulnerability is strictly worse than key exposure, but you probably shouldn&#x27;t have been using it anyways.
评论 #36790842 未加载
评论 #36791976 未加载
评论 #36791433 未加载
评论 #36790804 未加载
apienx将近 2 年前
Agent forwarding is discouraged by the OpenSSH crew. Yet, it&#x27;s commonly used because of the convenience it affords.<p>&quot;Agent forwarding should be enabled with caution. Users with the ability to bypass file permissions on the remote host (for the agent&#x27;s UNIX-domain socket) can access the local agent through the forwarded connection.&quot; <a href="https:&#x2F;&#x2F;man.openbsd.org&#x2F;ssh.1" rel="nofollow noreferrer">https:&#x2F;&#x2F;man.openbsd.org&#x2F;ssh.1</a><p>Glad the vulnerability got fixed.
wahern将近 2 年前
musl libc refuses to implement dlclose[1] for precisely the reason that modules too often misbehave when dropped at runtime, and requiring this behavior is very rarely needed if ever. The number of modules that will be loaded is almost always bounded, and keeping a module around in memory is mostly harmless; certainly less harmful on average than trying to unload it.<p>[1] see <a href="https:&#x2F;&#x2F;wiki.musl-libc.org&#x2F;functional-differences-from-glibc.html#Unloading-libraries" rel="nofollow noreferrer">https:&#x2F;&#x2F;wiki.musl-libc.org&#x2F;functional-differences-from-glibc...</a>
评论 #36798457 未加载
评论 #36797375 未加载
binkHN将近 2 年前
Full details: <a href="https:&#x2F;&#x2F;www.qualys.com&#x2F;2023&#x2F;07&#x2F;19&#x2F;cve-2023-38408&#x2F;rce-openssh-forwarded-ssh-agent.txt" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.qualys.com&#x2F;2023&#x2F;07&#x2F;19&#x2F;cve-2023-38408&#x2F;rce-openssh...</a>
quotemstr将近 2 年前
Why in the year of our Lord two thousand and twenty three do we still tolerate loading shared libraries with executable stacks?
pritambaral将近 2 年前
The suggestion floated in many comments here to create extra keypairs on remote hosts for access to other remotes from the former is a terrible idea.<p>Resident private keys on a compromised machine can be exfiltrated. Even if they&#x27;re passphrase protected, using them requires them to be decrypted on the machine they&#x27;re resident on.<p>`ssh-agent` is not the only SSH Agent. There exist SSH Agent implementations that are secure. E.g., gpg-agent. Use one of those, with the `ssh-add -c` flag or equivalent, and you get both security and convenience.
gunapologist99将近 2 年前
Note: you are not vulnerable if you&#x27;re not doing agent forwarding (-A).<p>Honestly, you probably should never do -A anyway; use -J (proxyjump) instead.<p><a href="https:&#x2F;&#x2F;www.man7.org&#x2F;linux&#x2F;man-pages&#x2F;man1&#x2F;ssh.1.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.man7.org&#x2F;linux&#x2F;man-pages&#x2F;man1&#x2F;ssh.1.html</a><p><a href="https:&#x2F;&#x2F;userify.com&#x2F;docs&#x2F;jumpbox" rel="nofollow noreferrer">https:&#x2F;&#x2F;userify.com&#x2F;docs&#x2F;jumpbox</a>
评论 #36792489 未加载
评论 #36792526 未加载
1letterunixname将近 2 年前
I use a USB security key for gpg-agent.<p>gpg-agent is used as an ssh-agent replacement (also replaces the venerable monkeysphere script). gpg agent forwarding is also needed via StreamLocalBindUnlink for signing built RPMs in a docker container on a remote (local LAN) Docker host. Sometimes rarely, I need to enable &quot;ssh-agent&quot; forwarding where I probably could proxyjump instead. My interactive ssh workflow is sometimes slowed as I use TOTP (via PAM) for 2FA. Noninteractive system accounts get dedicated ssh keys. host keys are constantly scanned and compared to a source of truth. Maybe I&#x27;ll get around to deploying LDAP with OpenSSH-LPK to move away from flat files.<p><i>Knee-jerk suggestion to rewrite the world in Rust combined with formal verification.</i><p>But seriously, being an expert knife juggler is still gambling with the obvious compared to using safer tools in a safer manner. Rust needs the ubiquity of GCC[0] (partially by adding them to LLVM and adding std crates) and more attention paid to bloat (cargo-bloat, etc) before attempting to rewrite the world (apart from special cases).<p>0. <a href="https:&#x2F;&#x2F;gcc.gnu.org&#x2F;backends.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;gcc.gnu.org&#x2F;backends.html</a>
kneebonian将近 2 年前
Can I just say I know it&#x27;s really dumb, but I loved that they published the explanation as a simple txt file, instead of setting up some whizbang website for it, or embedding it in their company blog.<p><a href="https:&#x2F;&#x2F;www.qualys.com&#x2F;2023&#x2F;07&#x2F;19&#x2F;cve-2023-38408&#x2F;rce-openssh-forwarded-ssh-agent.txt" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.qualys.com&#x2F;2023&#x2F;07&#x2F;19&#x2F;cve-2023-38408&#x2F;rce-openssh...</a>
评论 #36797024 未加载
berkle4455将近 2 年前
What&#x27;s a better solution if you want to be able to SSH across multiple machines? Do you need to always close the current connection to get back to localhost prior to a fresh SSH?<p>e.g. how would I ssh into foo, and then later into bar, or perhaps pull some code from github onto foo that is authenticated by my key?<p><pre><code> localhost -&gt; foo -&gt; bar localhost -&gt; foo -&gt; github access </code></pre> It seems like the answer is either: a) ssh -A, or b) install my private key on foo.
评论 #36792832 未加载
评论 #36792444 未加载
评论 #36800099 未加载
评论 #36791074 未加载
评论 #36791280 未加载
评论 #36791180 未加载
评论 #36791120 未加载
评论 #36791272 未加载
shandor将近 2 年前
I can’t parse the exact meaning of the ”victim system” and ”attacker controlled system” in the OpenSSH release page.<p>Does this vulnerability allow the attacker to compromise the original system where the user starts the agent-forwarded connection? Or ”only” compromise machines forward from the jump host?<p><a href="http:&#x2F;&#x2F;www.openssh.com&#x2F;releasenotes.html#9.3p2" rel="nofollow noreferrer">http:&#x2F;&#x2F;www.openssh.com&#x2F;releasenotes.html#9.3p2</a>
评论 #36791188 未加载
WhackyIdeas将近 2 年前
Am I reading this right - any system with ssh-agent installed by default is vulnerable?<p>The link is short on specifics.
评论 #36790504 未加载
评论 #36790521 未加载
评论 #36790455 未加载
评论 #36790471 未加载
评论 #36790777 未加载
mewmew07将近 2 年前
put this at the end of your ~&#x2F;.ssh&#x2F;config<p><pre><code> Host * ForwardAgent no </code></pre> <i>ssh config uses tabs for indentation, make sure you got those right</i>
seanhunter将近 2 年前
Man nice job. This is a really cool RCE and well handled.
exabrial将近 2 年前
Practically, what’s the immediate mitigation as updates are being published? Don’t ssh to unknown addresses from Linux?
评论 #36799830 未加载
a-dub将近 2 年前
why publish this before the patches are out?
评论 #36790498 未加载
slt2021将近 2 年前
what is CVSS&#x2F;severity of this? Critical? 9+?
评论 #36791701 未加载
评论 #36791195 未加载
评论 #36791725 未加载