CVE-2023-5616

What it actually does

The gnome-control-center interface fails to accurately reflect the enabled state of remote SSH login when systemd socket activation is configured for openssh-server, leaving the SSH service active despite user expectations that it is disabled.

Why it matters to the business

Organizations face increased risk of unauthorized remote access because users believe SSH is turned off when it remains available, potentially leading to undetected system exposure and subsequent compromise.

How an attack unfolds

An attacker performs network scanning to locate hosts listening on TCP port 22, then attempts SSH authentication against systems where the graphical interface misleadingly indicates remote login is disabled due to socket activation.

How to fix it

Verify actual SSH service state using systemctl commands, disable ssh.socket if remote access is unintended, and ensure desktop settings match the underlying systemd configuration.

How to confirm the fix worked

Compare systemctl status output for ssh.service and ssh.socket against the gnome-control-center remote login toggle to confirm they are synchronized.

Typical attack path

1. Scan networks for hosts with TCP port 22 open
2. Attempt SSH connections using valid credentials or brute-force techniques
3. Establish remote shell access if authentication succeeds

How to detect it

Examine authentication logs for SSH connections from unexpected sources and periodically compare service enablement state against graphical interface reports.

What your security team should do

• Audit Ubuntu systems for use of systemd socket activation with SSH
• Implement monitoring to detect SSH listeners that contradict GUI settings
• Provide user guidance on direct service verification rather than relying solely on the control center