OpenSSH before 9.3: ssh-add loads smartcard keys into ssh-agent without the requested destination constraints

Impact

From OpenSSH 8.9 through 9.2, ssh-add adds smartcard-backed keys to ssh-agent without applying the per-hop destination constraints the operator asked for. The constraint mechanism exists so that a forwarded agent can only be used to authenticate to the hosts on the intended path; silently dropping it means a key the operator believed was pinned to one hop can be used by anyone able to talk to the forwarded agent socket to authenticate anywhere that key is trusted. For operators who use hardware tokens and agent forwarding to reach jump hosts and then GPU nodes, this removes the control that was supposed to contain a compromised intermediate host. The flaw is in the client-side tooling, not in sshd, and it only affects smartcard keys - plain file-based keys get their constraints applied correctly. The NVD score of 9.8 with a network vector overstates it; a real attack needs access to the forwarded agent on a host in the path.

Who can reach it

An attacker with access to the forwarded ssh-agent socket on an intermediate host the operator has logged into - typically root on that host, or the same user. Requires the operator to have used ssh-add with destination constraints on a smartcard key on OpenSSH 8.9-9.2.

What to do

Upgrade OpenSSH to 9.3 or later, or take the distribution backport (Debian DSA-5586, Fedora, Gentoo GLSA 202307-01). This is a client-side package update on the hosts operators run ssh-add from - jump hosts, bastions and workstations - not a change to sshd on the GPU nodes, so no node drain is needed. Until it is rolled out, do not rely on destination constraints for smartcard keys; prefer not forwarding the agent at all, and use ProxyJump instead.

References

Related entries

• VMware vCenter: Out-of-bounds write in the DCERPC implementation - unauthenticated remote code executionCVE-2023-34048 · VMware vCenterCritical
• OpenSSH (ssh-agent): Remote code execution in ssh-agent PKCS#11 support when agent forwarding reaches a hostile hostCVE-2023-38408 · OpenSSH (ssh-agent)Critical
• Linux kernel NVMe target core (nvmet_req_complete submission-queue dereference): Nvmet_req_complete() dereferenced reqCVE-2023-53116 · Linux kernel NVMe target core (nvmet_req_complete submission-queue dereference)Critical
• Linux kernel (net/smc): When an incoming connection tries SMC-Rv2 and device setup fails, the listener does not resetCVE-2023-53382 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): On the server side of the SMC-R LLC handshake, adding a second link to a link group runsCVE-2023-54237 · Linux kernel (net/smc)Critical
• Linux kernel SUNRPC: double free of xprt_ctxt when a request is deferred twiceCVE-2023-54269 · Linux kernel SUNRPC (svc_defer, rq_xprt_ctxt handling)Critical