Bug 774090 – <net-misc/openssh-8.5_p1: Double-free in ssh-agent (CVE-2021-28041)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Sam James 2021-03-03 17:59:13 UTC]

From OpenSSH 8.5 release notes [0]:

"Security
========

 * ssh-agent(1): fixed a double-free memory corruption that was
   introduced in OpenSSH 8.2 . We treat all such memory faults as
   potentially exploitable. This bug could be reached by an attacker
   with access to the agent socket.

   On modern operating systems where the OS can provide information
   about the user identity connected to a socket, OpenSSH ssh-agent
   and sshd limit agent socket access only to the originating user
   and root. Additional mitigation may be afforded by the system's
   malloc(3)/free(3) implementation, if it detects double-free
   conditions.

   The most likely scenario for exploitation is a user forwarding an
   agent either to an account shared with a malicious user or to a
   host with an attacker holding root access.

* [irrelevant vulnerability for non-Sun PAM]"


[0] https://www.openssh.com/txt/release-8.5

[Comment 1 Larry the Git Cow 2021-03-04 07:04:02 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=77e3bbd9528150668daa02b6afffe1183a482782

commit 77e3bbd9528150668daa02b6afffe1183a482782
Author:     Patrick McLean <[e-mail]>
AuthorDate: 2021-03-04 07:03:14 +0000
Commit:     Patrick McLean <[e-mail]>
CommitDate: 2021-03-04 07:03:14 +0000

    net-misc/openssh-8.5_p1: Version bump
    
    Bug: https://bugs.gentoo.org/774090
    Copyright: Sony Interactive Entertainment Inc.
    Package-Manager: Portage-3.0.16, Repoman-3.0.2
    Signed-off-by: Patrick McLean <[e-mail]>

 net-misc/openssh/Manifest                          |   6 +
 .../openssh/files/openssh-8.5_p1-GSSAPI-dns.patch  | 112 +++++
 .../files/openssh-8.5_p1-X509-glue-13.0.patch      |  73 +++
 .../files/openssh-8.5_p1-hpn-15.1-X509-glue.patch  | 325 +++++++++++++
 .../files/openssh-8.5_p1-hpn-15.1-glue.patch       | 242 ++++++++++
 .../files/openssh-8.5_p1-hpn-15.1-sctp-glue.patch  |  18 +
 net-misc/openssh/openssh-8.5_p1.ebuild             | 515 +++++++++++++++++++++
 7 files changed, 1291 insertions(+)

[Comment 2 Sam James 2021-03-04 11:57:48 UTC]

Thanks! Tell us when ready to stable.

[Comment 3 Sam James 2021-03-28 05:44:07 UTC]

ping? chutzpah had no objections

[Comment 4 Agostino Sarubbo 2021-03-29 11:51:08 UTC]

amd64 stable

[Comment 5 Sam James 2021-03-29 14:49:42 UTC]

arm done

[Comment 6 Thomas Deutschmann (RETIRED) 2021-03-30 01:17:22 UTC]

x86 stable

[Comment 7 Rolf Eike Beer 2021-03-30 14:54:44 UTC]

hppa stable

[Comment 8 Agostino Sarubbo 2021-03-31 13:53:45 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2021-03-31 14:08:31 UTC]

s390 stable

[Comment 10 Rolf Eike Beer 2021-04-01 05:29:17 UTC]

sparc stable

[Comment 11 Agostino Sarubbo 2021-04-01 17:30:19 UTC]

ppc64 stable

[Comment 12 Sam James 2021-04-12 16:02:14 UTC]

arm64 done

all arches done

[Comment 13 John Helmert III 2021-04-12 17:16:50 UTC]

Please cleanup.

[Comment 14 Thomas Deutschmann (RETIRED) 2021-05-24 00:24:55 UTC]

Added to an existing GLSA request.

[Comment 15 GLSAMaker/CVETool Bot 2021-05-26 10:37:35 UTC]

This issue was resolved and addressed in
 GLSA 202105-35 at https://security.gentoo.org/glsa/202105-35
by GLSA coordinator Thomas Deutschmann (whissi).