high CVSS 7 EPSS 4.2% Public exploit available

CVE-2016-10010·OpenSSH vulnerability

sshd in OpenSSH before 7.4, when privilege separation is not used, creates forwarded Unix-domain sockets as root, which might allow local users to gain privileges via unspecified vectors, related to serverloop.c.

Severity
high
Software
OpenSSH
Fixed in
1:7.4p1-1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 4.2% — in the top 9% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

Until: 1:7.4p1-1

Fixed in: 1:7.4p1-1

How to fix this CVE

Update OpenSSH to version 7.4p1-1 or later to address a privilege escalation vulnerability in sshd when privilege separation is disabled. The vulnerability allows local users to exploit improper handling of Unix-domain socket creation, potentially gaining root access. Immediate patching is recommended for all affected systems, particularly those running sshd without privilege separation enabled.

sudo dnf update openssh-server openssh-clients

Defensia detects this vulnerability

How to check if you are affected

  1. Check installed OpenSSH version: ssh -V or sshd -v (compare output against 7.4p1-1)
  2. Verify privilege separation status: grep -i 'UsePrivilegeSeparation' /etc/ssh/sshd_config (if set to 'no' or commented out, system is vulnerable)
  3. Search sshd logs for unauthorized socket creation attempts: grep -i 'unix.*socket\|permission denied' /var/log/auth.log or /var/log/secure
  4. Confirm patch installation: dpkg -l | grep openssh (Debian/Ubuntu) or rpm -qa | grep openssh (RHEL/CentOS) and verify version >= 7.4p1-1

FAQ

What is CVE-2016-10010?

This vulnerability affects OpenSSH sshd when privilege separation is disabled, allowing local users to exploit improper Unix-domain socket creation to escalate privileges to root. The flaw resides in serverloop.c and enables attackers to manipulate socket ownership and permissions.

Is CVE-2016-10010 being actively exploited?

While not reported in CISA's Known Exploited Vulnerabilities list, public exploits are available on platforms like Exploit-DB, making it a viable attack vector for threat actors with local access.

What versions of OpenSSH are affected by CVE-2016-10010?

All OpenSSH versions prior to 7.4p1-1 are affected. The vulnerability is resolved in version 7.4p1-1 and later releases.

How do I check if my server is vulnerable to CVE-2016-10010?

Run 'ssh -V' to check your version, then verify privilege separation is enabled with 'grep UsePrivilegeSeparation /etc/ssh/sshd_config'. If version is below 7.4p1-1 and privilege separation is not enabled, your system is vulnerable.

Does Defensia detect CVE-2016-10010?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If OpenSSH is installed on a monitored server, CVE-2016-10010 will appear in your dashboard with remediation steps.

Related OpenSSH CVEs

CVE-2008-0166CVSS 9OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.
CVE-2016-6515CVSS 9The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
CVE-2016-10009CVSS 8.5Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS#11 modules by leveraging control over a forwarded agent-socket.
CVE-2016-6210CVSS 8.5sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.
CVE-2018-15473CVSS 8.5OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2016-10010. Free for 1 server.

Get started free