dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: disallow remote removal of PKCS#11 providers from

Browse Source 
ssh-agent by default, as this permits an attacker with access to a forwarded
agent a silly path-validity oracle. It's better just to be symmetric with the
restrictions on adding providers.

Note: a user of a forwarded agent can still remove a provider's _keys_
as it is important that access to keys can be easily revoked, this just
block removing entire providers by name.

Anthropic ANT-2026-DYLIZ0VY

OpenBSD-Commit-ID: 1a80510964e03bfd69336580a82a72cbb8983ea4
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:16:32 +11:00
1 parent cbd955ef9e
commit 69ccd0ff21
2 files changed
+16 -6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ssh-agent.1
+4 -4
View File
@@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-agent.1,v 1.89 2026/09/18 12:06:46 jsg Exp $
.\" $OpenBSD: ssh-agent.1,v 1.90 2026/10/30 07:18:18 djm Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: September 18 2026 $
.Dd $Mdocdate: October 30 2026 $
.Dt SSH-AGENT 1
.Os
.Sh NAME
@@ -144,8 +144,8 @@ The
.Cm allow-remote-pkcs11
option allows clients of a forwarded
.Nm
to load PKCS#11 or FIDO provider libraries.
By default only local clients may perform this operation.
to load PKCS#11 or FIDO provider libraries, and to remove PKCS#11 providers.
By default only local clients may perform these operations.
Note that signalling that an
.Nm
client is remote is performed by
ssh-agent.c
+12 -2
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: ssh-agent.c,v 1.335 2026/10/30 04:22:15 djm Exp $ */
/* $OpenBSD: ssh-agent.c,v 1.336 2026/10/30 07:18:18 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1709,11 +1709,21 @@ process_remove_smartcard_key(SocketEntry *e)
}
free(pin);
if (socket_is_remote(e) && !remote_add_provider) {
verbose("failed PKCS#11 remove of \"%.100s\": remote removal of "
"providers is disabled", provider);
goto send;
}
if (realpath(provider, canonical_provider) == NULL) {
verbose("failed PKCS#11 add of \"%.100s\": realpath: %s",
verbose("failed PKCS#11 remove of \"%.100s\": realpath: %s",
provider, strerror(errno));
goto send;
}
if (match_pattern_list(canonical_provider, allowed_providers, 0) != 1) {
verbose("refusing PKCS#11 remove of \"%.100s\": "
"provider not allowed", canonical_provider);
goto send;
}
debug_f("remove %.100s", canonical_provider);
for (id = TAILQ_FIRST(&idtab->idlist); id; id = nxt) {