ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

The remote host is affected by the vulnerability described in GLSA-202105-35 (OpenSSH: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSSH. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, able to access the socket of the forwarding agent,       might be able to execute arbitrary code with the privileges of the       process or cause a Denial of Service condition.
      Furthermore, a remote attacker might conduct a man-in-the-middle attack       targeting initial connection attempts where no host key for the server       has been cached by client yet.
  Workaround :

    There is no known workaround at this time.

The remote SUSE Linux SLED15 / SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2021:4153-1 advisory.

  - ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios,     such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to     an attacker-controlled host. (CVE-2021-28041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:4153-1 advisory.

  - ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios,     such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to     an attacker-controlled host. (CVE-2021-28041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ssh-agent in OpenSSH before 8.5 has a double free that     may be relevant in a few less-common scenarios, such as     unconstrained agent-socket access on a legacy operating     system, or the forwarding of an agent to an     attacker-controlled host.(CVE-2021-28041)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the openssh package has been released.

According to the versions of the openssh packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ssh-agent in OpenSSH before 8.5 has a double free that     may be relevant in a few less-common scenarios, such as     unconstrained agent-socket access on a legacy operating     system, or the forwarding of an agent to an     attacker-controlled host.(CVE-2021-28041)

  - A flaw was found in OpenSSH in versions 5.7 through     8.3, where an Observable Discrepancy occurs and leads     to an information leak in the algorithm negotiation.
    This flaw allows a man-in-the-middle attacker to target     initial connection attempts, where there is no host key     for the server that has been cached by the     client.(CVE-2020-14145)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 20.04 LTS / 20.10 host has packages installed that are affected by a vulnerability as referenced in the USN-4762-1 advisory.

  - ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios,     such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to     an attacker-controlled host. (CVE-2021-28041)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

OpenBSD Project reports :

ssh-agent(1): fixed a double-free memory corruption that was introduced in OpenSSH 8.2 . We treat all such memory faults as potentially exploitable. This bug could be reached by an attacker with access to the agent socket.

On modern operating systems where the OS can provide information about the user identity connected to a socket, OpenSSH ssh-agent and sshd limit agent socket access only to the originating user and root.
Additional mitigation may be afforded by the system's malloc(3)/free(3) implementation, if it detects double-free conditions.

The most likely scenario for exploitation is a user forwarding an agent either to an account shared with a malicious user or to a host with an attacker holding root access.

ssh-agent in OpenSSH 8.2 < 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
157020	GLSA-202105-35 : OpenSSH: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
156287	SUSE SLED15 / SLES15 Security Update : openssh (SUSE-SU-2021:4153-1)	Nessus	SuSE Local Security Checks	high
156277	openSUSE 15 Security Update : openssh (openSUSE-SU-2021:4153-1)	Nessus	SuSE Local Security Checks	high
150198	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1934)	Nessus	Huawei Local Security Checks	high
150185	EulerOS 2.0 SP9 : openssh (EulerOS-SA-2021-1955)	Nessus	Huawei Local Security Checks	high
150043	Photon OS 4.0: Openssh PHSA-2021-4.0-0033	Nessus	PhotonOS Local Security Checks	high
148637	EulerOS Virtualization 2.9.0 : openssh (EulerOS-SA-2021-1746)	Nessus	Huawei Local Security Checks	high
148631	EulerOS Virtualization 2.9.1 : openssh (EulerOS-SA-2021-1720)	Nessus	Huawei Local Security Checks	high
147985	Ubuntu 20.04 LTS : OpenSSH vulnerability (USN-4762-1)	Nessus	Ubuntu Local Security Checks	high
147897	FreeBSD : OpenSSH -- Double-free memory corruption in ssh-agent (76b5068c-8436-11eb-9469-080027f515ea)	Nessus	FreeBSD Local Security Checks	high
147662	OpenSSH 8.2 < 8.5	Nessus	Misc.	high

Detections

Analytics

CVE-2021-28041

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high