CVE-2023-51384

What it actually does

ssh-agent in OpenSSH applies destination constraints only to the first PKCS#11 key returned by a token, leaving additional keys unconstrained.

Why it matters to the business

Local users or processes could reach SSH destinations that were intended to be blocked by per-key constraints, increasing the chance of unauthorized remote access or lateral movement.

How an attack unfolds

An attacker with local access loads a PKCS#11 token that returns multiple private keys into ssh-agent while specifying destination constraints; only the first key receives the constraints, allowing the remaining keys to be used for SSH connections to any destination.

How to fix it

Upgrade OpenSSH to 9.6 or newer; apply commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b in openssh-portable.

How to confirm the fix worked

Confirm the running ssh-agent binary is built from a version containing commit 881d9c6af9da4257c69c327c4e2f1508b2fa754b; test addition of a multi-key PKCS#11 token and verify constraints are enforced on all keys.

Typical attack path

1. Obtain local access to a host running ssh-agent
2. Insert a PKCS#11 token configured to return multiple keys and request addition with destination constraints
3. ssh-agent stores the keys but applies constraints solely to the first key
4. Use any unconstrained key via ssh-agent to initiate SSH sessions to arbitrary hosts

How to detect it

Review ssh-agent debug or system logs for PKCS#11 key-addition events; correlate with outbound SSH connections that violate expected destination policies.

What your security team should do

• Upgrade all OpenSSH installations to a fixed version as soon as possible
• Audit systems for use of PKCS#11-backed keys in ssh-agent
• Review and tighten destination constraints where multiple keys may be returned
• Monitor SSH connection logs for unexpected destinations from hosts using ssh-agent