CVE-2016-10011: Buffer Overflow
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
Other sources
It was found that there is a theoretical leak of host private key material to privilege-separated child processes via realloc() when reading keys. No such leak was observed in practice for normal-sized keys, nor does a leak to the child processes directly expose key material to unprivileged users.
CVE assignment:
http://seclists.org/oss-sec/2016/q4/708
External References:
https://www.openssh.com/txt/release-7.4
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opensshto a version that resolves this vulnerability.Fixed in 7.4 - Upgrade
Upgrade
debian/opensshto a version that resolves this vulnerability.Fixed in 1:8.4p1-5+deb11u3Fixed in 1:8.4p1-5+deb11u7Fixed in 1:9.2p1-2+deb12u10Fixed in 1:9.2p1-2+deb12u9Fixed in 1:10.0p1-7+deb13u4Fixed in 1:10.0p1-7+deb13u2Fixed in 1:10.3p1-4 - Upgrade
Upgrade
OpenSSHto a version that resolves this vulnerability.Fixed in 7.4
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10011?
CVE-2016-10011 has a severity rating that indicates a potential risk of exposure of sensitive private-key information.
How do I fix CVE-2016-10011?
To fix CVE-2016-10011, upgrade your OpenSSH version to 7.4 or later.
What versions of OpenSSH are affected by CVE-2016-10011?
OpenSSH versions prior to 7.4 are affected by CVE-2016-10011.
Can CVE-2016-10011 allow unauthorized access?
CVE-2016-10011 can potentially allow local users to access sensitive information but does not directly lead to unauthorized access.
Is CVE-2016-10011 a local or remote vulnerability?
CVE-2016-10011 is a local vulnerability that requires user access for exploitation.