Privilege Escalation Vulnerability in OpenSSH - CVE-2016-10012
Summary
ALPINE-CVE-2016-10012: The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all compilers, which might allows local users to gain privileges... Affects openssh versions < 7.4_p1-r0. Fixed in 7.4_p1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSH is a widely used open-source implementation of the SSH (Secure Shell) protocol, which provides secure remote login and other secure network services over an insecure network. It is known for its strong security features, including encryption and authentication. However, certain versions of OpenSSH prior to 7.4 are vulnerable to a privilege escalation issue due to improper bounds checking in the shared memory manager, particularly related to pre-authentication compression.
Vulnerability Detail
The vulnerability, identified as CVE-2016-10012, originates from the shared memory manager in sshd (the OpenSSH server daemon). It fails to enforce a bounds check across all compilers, which could allow local users to exploit this weakness and gain elevated privileges by leveraging access to a sandboxed privilege-separation process. This could lead to unauthorized access and control over the system, posing significant security risks.
How To Fix
Minimum fixed version
7.4_p1-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling pre-authentication compression in your SSH configuration. This can be done by adding the following line to your sshd_config file: Compression no. After making changes, restart the SSH service with service sshd restart.
Conclusion
CVE-2016-10012 represents a significant security risk for systems running vulnerable versions of OpenSSH. It is crucial to update to the patched version to mitigate the risk of privilege escalation. Additionally, users should consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for openssh →
FAQ
CVE-2016-10012 is a vulnerability in OpenSSH that allows local users to escalate privileges due to improper bounds checking in the shared memory manager.
OpenSSH versions prior to 7.4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2016-10012 is 7.8, indicating a high severity level.
If an immediate update is not possible, consider disabling pre-authentication compression as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssh.
