CVE-2021-41617

What it actually does

sshd fails to initialize supplemental groups when executing helper programs for AuthorizedKeysCommand or AuthorizedPrincipalsCommand under non-default configurations that run the command as a different user, allowing the helpers to inherit the group privileges of the sshd process.

Why it matters to the business

Attackers with local access can obtain elevated privileges on systems running vulnerable OpenSSH versions with specific command configurations, potentially leading to full system compromise and unauthorized access to sensitive resources.

How an attack unfolds

An attacker with a local account on a system using non-default AuthorizedKeysCommand or AuthorizedPrincipalsCommand settings connects via SSH; the sshd process spawns the helper without resetting supplemental groups, allowing the helper to run with unintended elevated group privileges that the attacker can then leverage for privilege escalation.

How to fix it

Upgrade OpenSSH to version 8.8 or later; for Git-based installations apply the fix from commit bf944e3794eff5413f2df1ef37cddf96918c6bde. Review and restrict use of AuthorizedKeysCommand and AuthorizedPrincipalsCommand running as a different user.

How to confirm the fix worked

Confirm the installed OpenSSH version is 8.8 or newer, or verify the sshd source contains the group initialization fix from the referenced commit; test configurations that invoke the commands to ensure supplemental groups are cleared.

Typical attack path

1. Identify a target system running vulnerable OpenSSH with non-default AuthorizedKeysCommand or AuthorizedPrincipalsCommand configuration.
2. Obtain a local user account on the target.
3. Trigger SSH authentication that invokes the helper program.
4. Abuse the inherited supplemental group privileges to escalate to higher access levels.

How to detect it

Review sshd authentication logs and process execution records for invocations of AuthorizedKeysCommand or AuthorizedPrincipalsCommand helpers; look for unexpected group context or privilege changes during SSH sessions on unpatched systems.

What your security team should do

• Prioritize patching all OpenSSH instances to 8.8 or later within the next maintenance window.
• Audit sshd_config files for non-default AuthorizedKeysCommand and AuthorizedPrincipalsCommand settings.
• Disable or restrict use of these commands where possible until patched.
• Monitor for local privilege escalation attempts on affected hosts.