CVE-2023-38408 — The PKCS#11 feature in ssh-agent in OpenSSH before 9

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this is

01What is this vulnerability?

The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.

02Affected products

No structured affected-product list available — see references below for vendor advisories.

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

08Timeline

• Published: 2023-07-20T03:15:10.170
• Last modified: 2026-10-15T00:16:34.667

09References

• packetstormsecurity.com — http://packetstormsecurity.com/files/173661/OpenSSH-Forwarded-SSH-Agent-Remote-C…
• www.openwall.com — http://www.openwall.com/lists/oss-security/2023/07/20/1
• www.openwall.com — http://www.openwall.com/lists/oss-security/2023/07/20/2
• www.openwall.com — http://www.openwall.com/lists/oss-security/2023/09/22/11
• www.openwall.com — http://www.openwall.com/lists/oss-security/2023/09/22/9
• blog.qualys.com — https://blog.qualys.com/vulnerabilities-threat-research/2023/07/19/cve-2023-3840…
• github.com — https://github.com/openbsd/src/commit/7bc29a9d5cd697290aa056e94ecee6253d3425f8
• github.com — https://github.com/openbsd/src/commit/f03a4faa55c4ce0818324701dadbf91988d7351d
• github.com — https://github.com/openbsd/src/commit/f8f5a6b003981bb824329dc987d101977beda7ca
• lists.debian.org — https://lists.debian.org/debian-lts-announce/2023/08/msg00021.html