Loading vulnerability…
Privilege Escalation via OpenSSH Legacy SCP Permission Handling
OpenSSH versions before 10.3 can install a file obtained through scp with setuid or setgid permissions. The condition occurs when root performs a download using the legacy SCP protocol selected by the -O option without the -p preserve-mode option. This can create an unexpectedly privileged file on the local system.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A root-initiated legacy SCP download can leave a downloaded file setuid or setgid, contrary to expected permission handling. If the downloaded content is untrusted and subsequently executable or otherwise usable with those permissions, it can introduce a privilege-escalation risk.
If you can’t patch tonight, do this now.
Avoid running legacy SCP downloads as root with -O without -p. Prefer the default SFTP-based scp behavior or use a non-root account. Before using downloaded files, validate ownership and mode bits and remove any unexpected setuid or setgid permissions.
Patch, then assume compromise.
Upgrade OpenSSH to version 10.3 or later. Audit files previously downloaded through root-run legacy SCP sessions for unexpected setuid or setgid bits and remove those bits unless explicitly required.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.