ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssh | Openbsd | 8.2 (including) | 8.5 (excluding) |
| Openssh | Ubuntu | devel | * |
| Openssh | Ubuntu | focal | * |
| Openssh | Ubuntu | groovy | * |
| Openssh | Ubuntu | trusty | * |
| Openssh-ssh1 | Ubuntu | upstream | * |