OpenSSH ssh-agent double free vulnerability

Summary

A double-free memory corruption vulnerability in the OpenSSH ssh-agent could allow an attacker to crash the service or potentially execute arbitrary code.

Vulnerability ID

Vulnerability Overview

CVE-2021-28041

The ssh-agent in OpenSSH (versions 8.2 before 8.5) contains a double-free memory corruption vulnerability. This flaw can be exploited in less-common scenarios, such as when there is unconstrained agent-socket access on a legacy operating system, or when a user forwards their agent to an attacker-controlled host. An attacker with access to the agent socket could exploit this to cause a denial of service (crashing the agent) or potentially execute arbitrary code.

Affected Supported TeraStations

TS7010

 

Back to Security Notices

Date	Description
10/10/2023	Initial release

Back to Security Notices