Technical Analysis Published for OpenSSH’s Agent Forwarding RCE Vulnerability

Security researchers published a detailed analysis of CVE-2023-38408, a critical RCE in OpenSSH’s agent forwarding that enables attackers to load unsafe PKCS#11 libraries, make the ssh-pkcs11-helper stack executable, inject shellcode, and trigger a fault to run code as the forwarding user; the flaw affected OpenSSH versions prior to 9.3p2 (CVSS 9.8), researchers estimate millions of potentially vulnerable systems (Shodan-based counts), and OpenSSH released 9.3p2 with mitigations while recommending upgrades and cautious use of agent forwarding.