The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Alpine Linux | — | Upgrade openssh | Oct 1, 2024 | May 1, 2016 |
| Amazon_linux | — | Upgrade openssh | Nov 19, 2016 | Apr 30, 2016 |
| Centos_linux | — | Upgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade opensshUpgrade openssh-server | Aug 28, 2019 | May 1, 2016 |
| Debian | — | Upgrade openssh | Apr 18, 2016 | Apr 15, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 16, 2016 |
| Freebsd | — | Upgrade openssh-portable | Dec 10, 2025 | Sep 1, 2016 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Apr 30, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade opensshUpgrade openssh-askpassUpgrade openssh-serverUpgrade openssh-clientsUpgrade openssh-keycat | Nov 30, 2017 | Apr 30, 2016 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Apr 30, 2016 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | May 9, 2016 | May 1, 2016 |
| Oracle Solaris | — | Upgrade network/openssh to version 7.3.0.1-0.175.3.15.0.2.0 on Solaris 11.3 | May 29, 2017 | Apr 30, 2016 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-server-sysvinitUpgrade openssh-serverUpgrade opensshUpgrade pam_ssh_agent_auth | Nov 9, 2016 | Apr 13, 2016 |
| Redhat_linux | — | Upgrade openssh-serverUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-ldapUpgrade openssh-debuginfoUpgrade opensshNo solution existsUpgrade openssh-clients | Nov 4, 2016 | Apr 30, 2016 |
| Suse | — | Upgrade openssh-serverUpgrade openssh-commonUpgrade openssh-helpersUpgrade openssh-fipsUpgrade openssh-askpass-gnomeUpgrade openssh-clientsUpgrade openssh-openssl1-helpersUpgrade opensshUpgrade openssh-askpassUpgrade openssh-openssl1 | May 24, 2016 | Apr 30, 2016 |
| Ubuntu | — | Upgrade openssh-server | May 9, 2016 | Apr 30, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub