authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of…
Priority LOW 30CWE-119Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 8 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitive private-key information by leveraging access to a privilege-separated child process.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01101 65th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2017:2029 Released 2017-08-01 · Red Hat rating Moderateopenssh security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Client Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +1
- Red Hat Enterprise Linux ComputeNode (v. 7) openssh-7.4p1-11.el7, openssh-clients-7.4p1-11.el7, openssh-keycat-7.4p1-11.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssh-askpass-7.4p1-11.el7, openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Server (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssh-7.4p1-11.el7, openssh-askpass-7.4p1-11.el7, openssh-clients-7.4p1-11.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssh-cavs-7.4p1-11.el7, openssh-ldap-7.4p1-11.el7, openssh-server-sysvinit-7.4p1-11.el7 +1
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 4 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2017:2029 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2017:2029 |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-10011
- 2026-10-03 Alias added: GHSA-xcgr-wv7g-4j33
References
Advisory 1
Other 8
- https://security.netapp.com/advisory/ntap-20171130-0002/
- [oss-security] 20161219 Announce: OpenSSH 7.4 released
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03818en_us
- http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.647637
- [debian-lts-announce] 20180910 [SECURITY] [DLA 1500-1] openssh security update
- https://www.openssh.com/txt/release-7.4
- https://cert-portal.siemens.com/productcert/pdf/ssa-676336.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
More OpenBSD Openssh vulnerabilities
- TI-2023-19792 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently… CVSS 3.1CRITICAL 9.8
- TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
- TI-2023-10601 OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during… CVSS 3.1MEDIUM 6.5
- TI-2018-11033 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying… CVSS 3.1MEDIUM 5.9
- TI-2016-08105 Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4… CVSS 3.1HIGH 7.3
- TI-2023-28040 In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host… CVSS 3.1MEDIUM 6.5
Sources
- CVE-2016-10011 · CVE Program
- CVE-2016-10011 · NVD
- FIRST EPSS
- GHSA-xcgr-wv7g-4j33 · GitHub Advisory Database · CC BY 4.0
- CVE-2016-10011 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences