OpenSSH sshd: helper commands inherit sshd's supplemental groups, allowing privilege escalation

Impact

When sshd is configured to run an AuthorizedKeysCommand or AuthorizedPrincipalsCommand helper as a different user, supplemental groups are not reinitialized, so the helper keeps the group memberships of the sshd process. Whoever controls that helper binary or its inputs gains the privileges those extra groups carry, which on a login or management node can mean access to group-owned keys, shared state, or files that gate wider access. This only bites sites that use these non-default directives, but those are exactly the central key-management setups common on HPC login nodes and bastion hosts - the hosts that front an entire GPU cluster. Exposure is limited to systems using that configuration; a stock sshd config is unaffected.

Who can reach it

Local user on the host, and only where sshd is configured with AuthorizedKeysCommand or AuthorizedPrincipalsCommand plus a differing AuthorizedKeysCommandUser / AuthorizedPrincipalsCommandUser. Requires an existing local account; attack complexity is rated high.

What to do

Upgrade to OpenSSH 8.8 or later (affected: 6.2 through 8.x before 8.8) or apply the distribution backport - SUSE, Debian LTS and Fedora have shipped updates per the referenced advisories - then restart sshd. Existing SSH sessions survive a restart, so no node drain is needed. As an interim mitigation, drop the AuthorizedKeysCommand / AuthorizedPrincipalsCommand directives or run the helper as the same user sshd runs as, and make sure sshd is not a member of privileged supplemental groups.

References

Related entries

• Linux kernel (eBPF): eBPF improper input validation leading to local privilege escalationCVE-2021-4204 · Linux kernel (eBPF)High
• Linux kernel (cgroups v1): cgroups v1 release_agent lets a container with CAP_SYS_ADMIN (or an unconfined userns) runCVE-2022-0492 · Linux kernel (cgroups v1)High
• Linux kernel (io_uring): Use-after-free between io_uring and the unix GC - local rootCVE-2022-2602 · Linux kernel (io_uring)High
• Linux kernel (OverlayFS/FUSE): OverlayFS copies setuid files from a nosuid FUSE mountCVE-2023-0386 · Linux kernel (OverlayFS/FUSE)High
• Linux kernel (arch/s390/pci): When an SR-IOV VF is hot-unplugged its MMIO resources are freed, but the parent bus keepsCVE-2023-53123 · Linux kernel (arch/s390/pci)High
• Linux kernel (perf): Out-of-bounds write in perf_read_group() via read_size overflow - local rootCVE-2023-6931 · Linux kernel (perf)High