Is CVE-2023-28531 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-28531 being exploited in the wild.

How severe is CVE-2023-28531?

Critical severity, with a CVSS score of 9.8, published 17 March 2023.

Is there a fix for CVE-2023-28531?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2023-28531 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-28531?

Check whether you run NetApp Brocade Fabric Operating System, NetApp Hci Bootstrap Os, NetApp Solidfire Element Os or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-28531: OpenSSH ssh-add destination constraint bypass for smartcard keys

CVE-2023-28531 · Severity: critical · CVSS 9.8 · Published 2023-03-17

OpenSSH, a widely used tool for secure remote access, contains a flaw in how it handles smartcard security keys. When users attempt to apply specific security restrictions to these keys (limiting where they can be used), a logic error causes those restrictions to be ignored. This could allow a compromised intermediate server to use the security key in ways the user did not intend, potentially leading to unauthorized access across a network.

Technologies: NetApp Hci Bootstrap Os, OpenBSD Openssh. Vendors: NetApp, OpenBSD.

Quick answers

Is CVE-2023-28531 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-28531 being exploited in the wild.
How severe is CVE-2023-28531?: Critical severity, with a CVSS score of 9.8, published 17 March 2023.
Which products and versions are affected?: OpenBSD OpenSSH 8.9 to 9.2.
Is there a fix for CVE-2023-28531?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-28531 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-28531?: Check whether you run NetApp Brocade Fabric Operating System, NetApp Hci Bootstrap Os, NetApp Solidfire Element Os or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic error exists in the 'ssh-add' utility of OpenSSH (versions 8.9 through 9.2) when handling smartcard keys via PKCS#11. When a user adds a smartcard key to 'ssh-agent' using the '-h' flag to specify destination constraints, the constraints are not properly communicated to the agent. Consequently, the keys are added to the agent with no restrictions, bypassing the intended security policy that limits key usage to specific network hops. This vulnerability is specific to smartcard/PKCS#11 keys; standard file-based keys are unaffected. The issue is resolved in OpenSSH 9.3.

Affected products

OpenBSD OpenSSH 8.9 to 9.2

Timeline

2023-03-15: advisory: OpenSSH 9.3 released fixing the issue
2023-03-17: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.