CVE-2025-47914
📋 TL;DR
This vulnerability in SSH Agent servers allows attackers to cause a denial of service by sending specially crafted identity requests that trigger an out-of-bounds read, leading to program panic. It affects systems using vulnerable versions of Go's SSH agent implementation. The impact is primarily availability disruption rather than data compromise.
💻 Affected Systems
- Go SSH agent implementation
- Applications using golang.org/x/crypto/ssh/agent
📦 What is this software?
Crypto by Golang
⚠️ Risk & Real-World Impact
Worst Case
SSH agent crashes, disrupting SSH key-based authentication for all users relying on the agent, potentially preventing access to systems and services.
Likely Case
Targeted DoS attack against SSH agent services, causing temporary authentication failures until the service is restarted.
If Mitigated
Minimal impact with proper network segmentation and monitoring; service restart recovers functionality.
🎯 Exploit Status
Exploitation requires network access to the SSH agent socket. The vulnerability is in message parsing, making it straightforward to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in golang.org/x/crypto/ssh/agent with commit 721960
Vendor Advisory: https://groups.google.com/g/golang-announce/c/w-oX3UxNcZA
Restart Required: Yes
Instructions:
1. Update Go modules: go get -u golang.org/x/crypto/ssh/agent. 2. Rebuild and redeploy affected applications. 3. Restart SSH agent services.
🔧 Temporary Workarounds
Restrict SSH agent socket access
linuxLimit filesystem permissions on the SSH agent socket to prevent unauthorized access
chmod 600 ~/.ssh/agent.sock
chmod 600 /tmp/ssh-*/agent.*
Use SSH agent forwarding restrictions
allDisable SSH agent forwarding for untrusted connections
Add 'AllowAgentForwarding no' to sshd_config
🧯 If You Can't Patch
- Implement network segmentation to isolate SSH agent services from untrusted networks
- Monitor for SSH agent crashes and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check Go module version: go list -m golang.org/x/crypto/ssh/agentCheck Version:
go version && go list -m golang.org/x/crypto/ssh/agentVerify Fix Applied:
Verify the module version includes commit 721960 or later📡 Detection & Monitoring
Log Indicators:
- SSH agent process crashes
- Panic messages in system logs containing 'out of bounds' or 'ssh/agent'
Network Indicators:
- Unusual connections to SSH agent sockets (typically /tmp/ssh-* or ~/.ssh/agent.sock)
SIEM Query:
process.name:"ssh-agent" AND (event.action:"crashed" OR log.message:"panic")