OpenSSH Legacy SCP Protocol Setuid and Setgid Vulnerability

A vulnerability exists in OpenSSH versions prior to 10.3, where files downloaded using the SCP command in legacy mode (-O) as the root user, without the -p flag to preserve file modes, may inadvertently retain setuid or setgid permissions. This behavior contradicts user expectations and dates back to the original Berkeley RCP program.

Impact

Exploitation of this vulnerability can lead to unintended execution of files with elevated privileges, potentially allowing for unauthorized actions or access on the system.

Reproduction

To reproduce this vulnerability, download a file using SCP in legacy mode (-O) as the root user, and do not use the -p flag. The downloaded file will retain its setuid or setgid bits, contrary to typical expectations.

Remediation

Users can upgrade to OpenSSH 10.3 or later, where this issue has been addressed.