Privilege Escalation Vulnerability in OpenSSH Affecting Multiple Versions

CVE-2021-41617

Summary

The sshd component of OpenSSH versions 6.2 through 8.x, prior to 8.8, contains a significant vulnerability that can lead to privilege escalation. This issue arises when specific non-default configurations are applied, leading to supplemental groups not being initialized properly. If the configuration allows the execution of AuthorizedKeysCommand or AuthorizedPrincipalsCommand as a different user, these commands may inherit group privileges from the sshd process, thereby exposing the system to unauthorized access and control. Users are advised to review their configurations and update to the latest version to mitigate potential risks.

References