Linux Kernel ptrace Memory Disclosure SSH Keys | MSSP Advisory

Qualys discovered a nine-year-old vulnerability in the Linux kernel's ptrace system call that allows local users to extract SSH keys and password hashes from memory. The flaw affects most Linux distributions and requires local access to exploit, making it particularly dangerous in environments where multiple users share systems or where attackers have already gained initial foothold.

Your RMM agents, jump boxes, and Linux-based security tools run with elevated privileges on client networks, making them prime targets for privilege escalation once an attacker gains any local access. Every client running Linux servers or workstations becomes a secondary compromise risk if attackers extract SSH keys to pivot between systems, and you need to communicate this risk before clients discover it through their own security audits.

📬