The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 6.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 7.1 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Aix 7.2 Openssh_advisory9 | — | — | Dec 19, 2016 | Apr 30, 2016 |
| Alpine Linux | — | Upgrade openssh | Oct 1, 2024 | May 1, 2016 |
| Amazon_linux | — | Upgrade openssh | Nov 19, 2016 | Apr 30, 2016 |
| Centos_linux | — | Upgrade openssh-serverUpgrade openssh-askpassUpgrade opensshUpgrade openssh-clientsUpgrade openssh-debuginfoUpgrade openssh-ldapUpgrade pam_ssh_agent_auth | Aug 28, 2019 | May 1, 2016 |
| Debian | — | Upgrade openssh | Apr 18, 2016 | Apr 15, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 16, 2016 |
| Freebsd | — | Upgrade openssh-portable | Dec 10, 2025 | Sep 1, 2016 |
| Gentoo Linux | — | Upgrade net-misc/openssh. | Oct 30, 2017 | Apr 30, 2016 |
| Huawei Euleros 2_0_sp1 | — | Upgrade openssh-serverUpgrade opensshUpgrade openssh-askpassUpgrade openssh-keycatUpgrade openssh-clients | Nov 30, 2017 | Apr 30, 2016 |
| Ibm Aix | — | Apply the fix or workaround for openssh_advisory9 | Nov 30, 2017 | Apr 30, 2016 |
| Openbsd Openssh | — | Upgrade to the latest version of OpenSSH | May 9, 2016 | May 1, 2016 |
| Oracle Solaris | — | Upgrade network/openssh to version 7.3.0.1-0.175.3.15.0.2.0 on Solaris 11.3 | May 29, 2017 | Apr 30, 2016 |
| Oracle_linux | — | Upgrade openssh-ldapUpgrade openssh-clientsUpgrade openssh-keycatUpgrade openssh-askpassUpgrade openssh-serverUpgrade openssh-server-sysvinitUpgrade pam_ssh_agent_authUpgrade openssh | Nov 9, 2016 | Apr 13, 2016 |
| Redhat_linux | — | Upgrade opensshUpgrade openssh-debuginfoUpgrade openssh-askpassUpgrade pam_ssh_agent_authUpgrade openssh-serverUpgrade openssh-ldapNo solution existsUpgrade openssh-clients | Nov 4, 2016 | Apr 30, 2016 |
| Suse | — | Upgrade openssh-serverUpgrade openssh-commonUpgrade openssh-openssl1-helpersUpgrade openssh-askpassUpgrade openssh-clientsUpgrade openssh-askpass-gnomeUpgrade openssh-fipsUpgrade opensshUpgrade openssh-openssl1Upgrade openssh-helpers | May 24, 2016 | Apr 30, 2016 |
| Ubuntu | — | Upgrade openssh-server | May 9, 2016 | Apr 30, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub