sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. References: https://www.openwall.com/lists/oss-security/2021/09/26/1 https://www.openssh.com/txt/release-8.8 https://www.openssh.com/security.html
Created openssh tracking bugs for this issue: Affects: fedora-all [bug 2008292]
Upstream commits: https://github.com/openssh/openssh-portable/commit/f3cbe43e28fe71427d41cfe3a17125b972710455 https://github.com/openssh/openssh-portable/commit/bf944e3794eff5413f2df1ef37cddf96918c6bde
From sshd_config's man page [1] helper programs for AuthorizedKeysCommand/AuthorizedPrincipalsCommand must be owned by root and not writable by group or others. This flaw requires local system access for the unprivileged malicious user to be able to tamper with the process being run to potentially gain additional privileges on the system. [1] https://man.openbsd.org/sshd_config#AuthorizedKeysCommand
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2021:4782 https://access.redhat.com/errata/RHSA-2021:4782
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-41617
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:2013 https://access.redhat.com/errata/RHSA-2022:2013