CVE-2023-28531

What it actually does

ssh-add in OpenSSH bypasses per-hop destination constraints when adding smartcard keys to ssh-agent, allowing keys to authenticate to hosts beyond their intended scope.

Why it matters to the business

Organizations relying on constrained smartcard SSH keys face expanded unauthorized access risk, enabling potential lateral movement across systems and increased exposure of sensitive resources.

How an attack unfolds

An attacker with local access or influence over the ssh-add process supplies a smartcard key that should be destination-constrained; the vulnerable ssh-add omits the constraints when loading it into ssh-agent, after which the attacker uses the now-unrestricted agent for SSH authentication to additional hosts.

How to fix it

Upgrade OpenSSH to version 9.3 or later on all affected systems including OpenBSD OpenSSH and NetApp products; apply any vendor-specific patches for Brocade Fabric OS, HCI Bootstrap OS, and SolidFire Element OS once released.

How to confirm the fix worked

Confirm OpenSSH version reports 9.3 or newer; test ssh-add operations with constrained smartcard keys and verify destination restrictions are enforced in the resulting ssh-agent state.

Typical attack path

1. Locate systems running OpenSSH versions 8.9 through 9.2
2. Gain ability to invoke ssh-add with a smartcard key
3. Trigger key addition that omits intended destination constraints
4. Leverage the loaded key via ssh-agent to reach previously restricted hosts
5. Perform unauthorized actions or move laterally

How to detect it

Examine ssh-agent debug or verbose logs around key addition events for missing destination constraint strings; correlate SSH authentication records showing access from agents that should have been limited; review system logs for ssh-add invocations on versions prior to 9.3.

What your security team should do

• Prioritize upgrade of all OpenSSH instances to 9.3 or later
• Audit current ssh-agent contents for any unconstrained smartcard keys
• Review and tighten SSH key management policies for smartcard use
• Monitor SSH authentication logs for unexpected host access patterns