OpenSSH X11 Forwarding Local Privilege Escalation

Mitigation Strategies

Immediate mitigation involves disabling X11 forwarding on affected OpenSSH clients when it is not required.

• Avoid using SSH options -X or -Y which enable X11 forwarding.
• Set ForwardX11 to no in your SSH client configuration files (~/.ssh/config or /etc/ssh/ssh_config).

There is no released package fix available yet, but a proposed patch suggests preferring the filesystem X11 socket over the abstract UNIX socket to prevent this attack.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the OpenSSH client on Linux systems when X11 forwarding is enabled. A local unprivileged attacker can hijack the client-side X11 forwarding connection by pre-binding the preferred abstract UNIX socket name before the OpenSSH client opens the forwarded X11 connection.

The issue arises because Linux attempts to connect to abstract UNIX sockets before filesystem sockets, and abstract sockets are not protected by filesystem permissions. This allows an attacker to pre-bind the abstract socket name and intercept the forwarded X11 traffic.

As a result, the attacker can compromise the confidentiality of the forwarded X11 traffic, including sensitive window contents and input, and may manipulate the forwarded session to some extent.

Exploitation requires local access to the client host, X11 forwarding enabled (e.g., using -X or -Y), and a local UNIX-domain X socket being used for the DISPLAY.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can lead to a local attacker intercepting and viewing the contents of your forwarded X11 sessions, which may include sensitive graphical data and input.

This compromises the confidentiality of your X11 forwarding traffic and may allow the attacker to manipulate the forwarded session, potentially affecting the integrity of your session.

However, the attack requires local access to your Linux client machine and specific client-side configurations, so remote attackers cannot exploit this vulnerability directly.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the OpenSSH client on your Linux host is configured to use X11 forwarding and if the client version is vulnerable (e.g., openssh-9.9p1-22.el10_2). Specifically, detection involves verifying whether X11 forwarding is enabled using options like -X or -Y or the configuration setting ForwardX11 yes.

You can check the SSH client configuration by inspecting the SSH command usage or the SSH client configuration file (~/.ssh/config or /etc/ssh/ssh_config) for X11 forwarding settings.

• Check OpenSSH client version: `ssh -V`
• Check if X11 forwarding is enabled in SSH config: `grep -i ForwardX11 ~/.ssh/config /etc/ssh/ssh_config`
• Check active SSH connections with X11 forwarding enabled by looking for DISPLAY environment variable: `ps aux | grep ssh` and `echo $DISPLAY`

Since the attack requires a local unprivileged attacker to pre-bind the abstract UNIX socket, monitoring for unexpected abstract socket bindings related to X11 forwarding could also help detect exploitation attempts, though no specific commands are provided.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in OpenSSH allows a local unprivileged attacker to hijack client-side X11 forwarding connections, potentially compromising the confidentiality of forwarded X11 traffic, including sensitive window contents and input.

Such a compromise of confidentiality could impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding sensitive information and ensuring confidentiality of data in transit.

However, exploitation requires local access and specific client configurations (X11 forwarding enabled), limiting the scope of risk to environments where these conditions are met.

Mitigations such as disabling X11 forwarding when not needed can reduce the risk and help maintain compliance with these standards.

Useful 0 Not Useful 0