# Ssh-keysign-pwn: Read root-owned files as unprivileged user **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [May 15, 2026, 9:43am UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481 "2026-05-15T09:43:17Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![mtds](https://avatars.discourse-cdn.com/v4/letter/m/e495f1/32.png) [@mtds](https://forums.rockylinux.org/u/mtds)\ **Post date:** [May 15, 2026, 9:43am UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/1 "2026-05-15T09:43:17Z")
Hi all. I am wondering if anybody has already seen the following vulnerability: > **[GitHub - 0xdeadbeefnetwork/ssh-keysign-pwn: Steal SSH host private keys and /etc/shadow via...](https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn)** > > Steal SSH host private keys and /etc/shadow via the ptrace\_may\_access mm-NULL bypass + pidfd\_getfd. Pre-31e62c2ebbfd kernels. I tested it briefly on an RL 9.7 (kernel 5.14.0-611.54.1.el9\_7) and I was able, as unprivileged user, to extract the SSH host key (the private part) from under /etc/ssh. I am not sure if in this case there are mitigation available either, since the exploit is relying on ptrace. Is there anybody looking into it already? Best regards, Matteo ---
**Author:** ![jdieter](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/jdieter/32/5063_2.png) [@jdieter](https://forums.rockylinux.org/u/jdieter)\ **Post date:** [May 15, 2026, 9:57am UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/2 "2026-05-15T09:57:56Z")
Yeah, we’re looking into it. We’re still working on getting the fix out for Fragnesia in the new security repo, so this is one more fix to add on to it. ---
**Author:** ![mtds](https://avatars.discourse-cdn.com/v4/letter/m/e495f1/32.png) [@mtds](https://forums.rockylinux.org/u/mtds)\ **Post date:** [May 15, 2026, 10:02am UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/3 "2026-05-15T10:02:06Z")
As a quick fix/workaround (which may also hampers any workflow that rely on `ptrace`): sysctl kernel.yama.ptrace\_scope=2 For whoever is running systems opened to user’s access (AKA: ssh bastion hosts, HPC clusters of any size), this vulnerability is quite serious (on the level of the previous two, I would say). ---
**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\ **Post date:** [May 15, 2026, 10:54am UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/4 "2026-05-15T10:54:22Z")
> [@mtds](#): > > As a quick fix/workaround (which may also hampers any workflow that rely on `ptrace`): > > sysctl kernel.yama.ptrace\_scope=2 _Note that setting this to anything except zero will break programs!_ ---
**Author:** ![mtds](https://avatars.discourse-cdn.com/v4/letter/m/e495f1/32.png) [@mtds](https://forums.rockylinux.org/u/mtds)\ **Post date:** [May 15, 2026, 12:41pm UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/5 "2026-05-15T12:41:45Z")
Indeed and that’s why I wrote that the mitigation may hampers quite some workflows but in our case, running a multi-user system with hundreds of users running jobs, there was no other easy workaround that we could have applied in less than an hour after we received this notification (15/05 10:30 AM CEST). We tested the behavior on our systems after the mitigation: debugging may certainly seriously be affected (in some way) and some other cases as well but currently the side effects are reasonable enough to live with (until a patched kernel arrives). ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [July 14, 2026, 12:42pm UTC](https://forums.rockylinux.org/t/ssh-keysign-pwn-read-root-owned-files-as-unprivileged-user/20481/6 "2026-07-14T12:42:36Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.