--- id: CVE-2023-38408 title: >- The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system summary: >- The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe… severity: critical cvss: 9.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-428 vendor: openbsd product: openssh affected: - openssh < 9.3 - openssh = 9.3 - fedora = 37 - fedora = 38 patched: - openssh 9.3 published: '2023-07-20' updated: '2026-10-15' sourceUpdated: '2026-10-15T00:16:34.667' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-38408' references: - url: >- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/07/20/1' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/07/20/2' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/09/22/11' label: cve@mitre.org - url: 'http://www.openwall.com/lists/oss-security/2023/09/22/9' label: cve@mitre.org - url: >- https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent label: cve@mitre.org - url: >- https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 label: cve@mitre.org - url: >- https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d label: cve@mitre.org - url: >- https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca label: cve@mitre.org - url: 'https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html' label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/ label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/ label: cve@mitre.org - url: 'https://news.ycombinator.com/item?id=36790196' label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202307-01' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20230803-0010/' label: cve@mitre.org - url: 'https://support.apple.com/kb/HT213940' label: cve@mitre.org - url: 'https://www.openssh.com/security.html' label: cve@mitre.org - url: 'https://www.openssh.com/txt/release-9.3p2' label: cve@mitre.org - url: >- https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt label: cve@mitre.org - url: >- https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408 label: cve@mitre.org - url: >- http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-Code-Execution.html label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/07/20/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/07/20/2' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/09/22/11' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'http://www.openwall.com/lists/oss-security/2023/09/22/9' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-38408-remote-code-execution-in-opensshs-forwarded-ssh-agent label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CEBTJJINE2I3FHAUKKNQWMFGYMLSMWKQ/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAXVQS6ZYTULFAK3TEJHRLKZALJS3AOU/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://news.ycombinator.com/item?id=36790196' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202307-01' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20230803-0010/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT213940' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openssh.com/security.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.openssh.com/txt/release-9.3p2' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://www.vicarius.io/vsociety/posts/exploring-opensshs-agent-forwarding-rce-cve-2023-38408 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd - exploit-available - cve.org epss: 0.797 epssPercentile: 0.99604 exploits: github: 10 githubRepos: - 'https://github.com/kali-mx/CVE-2023-38408' - 'https://github.com/LucasPDiniz/CVE-2023-38408' - 'https://github.com/classic130/CVE-2023-38408' checkedAt: '2026-10-15T01:08:37.768Z' exploitAvailable: true ingestedAt: '2026-10-15T01:08:04.204Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: total timestamp: '2024-10-15T17:36:21.400489Z' --- ## Overview The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. ## Affected - `openssh < 9.3` - `openssh = 9.3` - `fedora = 37` - `fedora = 38` ## Remediation Upgrade past the affected range: - `openssh 9.3`