The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-openssh | Oct 1, 2024 | May 1, 2016 | |
| Amazon_linux | — | amazon-linux-upgrade-openssh | Nov 19, 2016 | Apr 30, 2016 |
| Centos_linux | — | centos-upgrade-opensshcentos-upgrade-openssh-askpasscentos-upgrade-openssh-clientscentos-upgrade-openssh-debuginfocentos-upgrade-openssh-ldapcentos-upgrade-openssh-servercentos-upgrade-pam_ssh_agent_auth | Aug 28, 2019 | May 1, 2016 |
| Debian | debian-upgrade-openssh | Apr 18, 2016 | Apr 15, 2016 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | May 16, 2016 | |
| Freebsd | freebsd-upgrade-package-openssh-portable | Dec 10, 2025 | Sep 1, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-net-misc-openssh | Oct 30, 2017 | Apr 30, 2016 | |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-opensshhuawei-euleros-2_0_sp1-upgrade-openssh-askpasshuawei-euleros-2_0_sp1-upgrade-openssh-clientshuawei-euleros-2_0_sp1-upgrade-openssh-keycathuawei-euleros-2_0_sp1-upgrade-openssh-server | Nov 30, 2017 | Apr 30, 2016 | |
| Ibm Aix | ibm-aix-openssh_advisory9 | Nov 30, 2017 | Apr 30, 2016 | |
| Openbsd Openssh | openbsd-openssh-upgrade-latest | May 9, 2016 | Apr 30, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-network-openssh-7-3-0-1-0-175-3-15-0-2-0 | May 29, 2017 | Apr 30, 2016 | |
| Oracle_linux | — | oracle-linux-upgrade-opensshoracle-linux-upgrade-openssh-askpassoracle-linux-upgrade-openssh-clientsoracle-linux-upgrade-openssh-keycatoracle-linux-upgrade-openssh-ldaporacle-linux-upgrade-openssh-serveroracle-linux-upgrade-openssh-server-sysvinitoracle-linux-upgrade-pam-ssh-agent-auth | Nov 9, 2016 | Apr 13, 2016 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-opensshredhat-upgrade-openssh-askpassredhat-upgrade-openssh-clientsredhat-upgrade-openssh-debuginforedhat-upgrade-openssh-ldapredhat-upgrade-openssh-serverredhat-upgrade-pam_ssh_agent_auth | Nov 4, 2016 | Apr 30, 2016 | |
| Suse | — | suse-upgrade-opensshsuse-upgrade-openssh-askpasssuse-upgrade-openssh-askpass-gnomesuse-upgrade-openssh-clientssuse-upgrade-openssh-commonsuse-upgrade-openssh-fipssuse-upgrade-openssh-helperssuse-upgrade-openssh-openssl1suse-upgrade-openssh-openssl1-helperssuse-upgrade-openssh-server | May 24, 2016 | Apr 30, 2016 |
| Ubuntu | ubuntu-upgrade-openssh-server | May 9, 2016 | Apr 30, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub