CVE-2021-28041

An attacker who can send crafted messages to an ssh-agent (e.g., via unconstrained agent-socket access on a legacy OS, or by having the agent forwarded to an attacker-controlled host) can trigger the double-free. The attacker sends a sequence of constraint types where an earlier constraint (like `SSH_AGENT_CONSTRAIN_LIFETIME`) fails, causing the function to jump to the `err:` label, which calls `free(ext_name)` even though `ext_name` was never allocated in that path. This double-free can corrupt heap metadata and potentially lead to code execution. The advisory notes this is relevant in 'a few less-common scenarios' [ref_id=1].

The double-free vulnerability resides in `parse_key_constraints()` in `ssh-agent.c`. The old code freed `ext_name` only after the `SSH_AGENT_CONSTRAIN_EXTENSION` case, but if an error occurred earlier (e.g., in `SSH_AGENT_CONSTRAIN_LIFETIME` or `SSH_AGENT_CONSTRAIN_CONFIRM`) the function jumped to the `err:` label, which also called `free(ext_name)` — however, `ext_name` was never allocated in those paths, leading to a double-free on a subsequent call. The patch factors the extension parsing into `parse_key_constraint_extension()` and removes the shared `ext_name` variable from the parent function, eliminating the dangling free.

The patch refactors the `SSH_AGENT_CONSTRAIN_EXTENSION` handling into a new helper function `parse_key_constraint_extension()` and removes the `ext_name` variable from `parse_key_constraints()`. In the old code, `ext_name` was declared in the parent function and freed only after the extension case, but the `err:` label also called `free(ext_name)` — if an error occurred in a different constraint branch (where `ext_name` was never allocated), the `err:` path would free an uninitialized or stale pointer, causing a double-free. The new code allocates and frees `ext_name` entirely within the helper, so no dangling free can occur across different constraint types [ref_id=1].