OpenSSH client X11 forwarding: a local user can pre-bind the X socket and hijack a forwarded session

Impact

On a host where users run the OpenSSH client with X11 forwarding enabled and a local UNIX-domain X socket, an unprivileged local user can claim the preferred abstract socket name first and intercept another user's forwarded X11 traffic. That exposes window contents and keystrokes of the hijacked session and permits some manipulation of it. The realistic target in a GPU estate is a shared HPC login or head node where many users hold shells on the same machine and forward X for profilers and visualization tools. Headless compute nodes with no X11 forwarding in use are not exposed by this flaw.

Who can reach it

A local unprivileged user with a shell on the same client host as the victim, who must then start an X11-forwarded SSH session (the CVSS vector requires user interaction). No remote access and no elevated privilege is needed by the attacker.

What to do

Update the OpenSSH client packages; Red Hat has shipped errata across RHEL 8, 9 and 10 (RHSA-2026:36759 and the RHSA-2026:47755/47756/47757 and 2026:54387 series), and the record does not name upstream fixed versions. No reboot and no sshd restart is required for the client side; new sessions pick up the fixed binary. Where a maintenance window is not available, mitigate on multi-user login nodes by setting ForwardX11 no and ForwardX11Trusted no in ssh_config and having users tunnel graphical tools another way.

References

Related entries

• Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.x: Proof that interrupt remapping is not a completeCVE-2013-3495 · Intel VT-d interrupt remapping engine as used by Xen 3.3.x-4.3.xMedium
• Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devices: A tenant clears theCVE-2015-2150 · Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devicesMedium
• Intel CPU (AEPIC Leak): Stale data read from the legacy xAPIC MMIO page - leaks SGX enclave and cross-domain dataCVE-2022-21233 · Intel CPU (AEPIC Leak)Medium
• Linux kernel (arch/x86/kvm/vmx): The return stack buffer was not refilled on VM exit when the host used IBRS/eIBRS asCVE-2022-49611 · Linux kernel (arch/x86/kvm/vmx)Medium
• AMD CPU (DIV0): Division-by-zero leaves stale quotient data readable across contexts - confidentiality loss on Zen 1CVE-2023-20588 · AMD CPU (DIV0)Medium
• KVM (nested VMX): Missing CR0/CR4 consistency checks in nVMX - L2 guest can break nested-virt assumptions / crash hostCVE-2023-30456 · KVM (nested VMX)Medium