CVE-2025-52936: Debian 12 sslh Link Following Vulnerability — Detection and Patching Guide

A critical security flaw has been identified in sslh, a versatile protocol multiplexer widely used in Debian 12 environments to share a single port for multiple protocols (e.g., SSH and HTTPS). The Debian Long Term Support (LTS) team released advisory DLA-4713-1, addressing CVE-2025-52936, a link-following vulnerability that poses a significant risk of Local Privilege Escalation (LPE).

Because sslh typically operates with root privileges to bind to privileged ports (such as port 443 or 22), this vulnerability allows a local attacker to manipulate the filesystem during the service's operation. Successful exploitation could lead to the overwriting of arbitrary system files or the disclosure of sensitive data, effectively resulting in a full system compromise from a local foothold.

Defenders must prioritize patching this vulnerability to maintain the integrity of Linux perimeter infrastructure.

Technical Analysis

Affected Product: sslh (SSL/SSH multiplexer) Affected Platform: Debian 12 (Bookworm) Advisory: DLA-4713-1 CVE Identifier: CVE-2025-52936

Vulnerability Mechanics

CVE-2025-52936 is classified as a Link Following vulnerability (CWE-59). The flaw occurs during the file handling operations of sslh, likely related to the creation of Process ID (PID) files or chroot directory management during startup or restart sequences.

In a typical link-following attack scenario:

1. Race Condition: An attacker with local access creates a symbolic link (symlink) pointing to a sensitive file (e.g., /etc/shadow, /root/.ssh/authorized_keys) in a location where sslh intends to write.
2. Insecure Write: When sslh (running as root) attempts to write to its intended target file, the operating system follows the attacker's symlink.
3. Impact: The write operation overwrites the privileged file. This can corrupt system critical files or, if the content is attacker-controlled, grant the attacker root access.

Exploitation Status

While there is no current confirmation of active, in-the-wild exploitation targeting this specific CVE at the time of this advisory, the nature of the vulnerability makes it trivial to exploit once local access is established (e.g., via a web shell or compromised low-privilege user). Given the high value of sslh in network edge configurations, it is expected that exploit code will be integrated into automated privilege escalation frameworks (like LinPEAS) shortly.

Detection & Response

Detecting link-following race conditions in real-time is notoriously difficult without advanced kernel auditing (e.g., Auditd). However, defenders can hunt for post-exploitation behavior or verify the presence of the vulnerable software.

SIGMA Rules

The following rules detect unexpected child processes spawned by sslh (indicating potential successful exploitation) and suspicious file system interactions.

---
title: Potential Privilege Escalation via sslh Spawning Shell
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects sslh spawning interactive shells, which is highly unusual and indicative of successful local privilege escalation.
references:
 - https://linuxsecurity.com/advisories/deblts/debian-dla-4713-1-sslh
author: Security Arsenal
date: 2026/01/15
tags:
 - attack.privilege_escalation
 - attack.t1068
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 ParentImage|endswith: '/sslh'
 Image|endswith:
   - '/bash'
   - '/sh'
   - '/zsh'
   - '/dash'
 condition: selection
falsepositives:
 - Administrative testing (rare)
level: critical
---
title: sslh Process Creation with Vulnerable Version
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Identifies running instances of sslh that may match the vulnerable version range prior to patching.
references:
 - https://linuxsecurity.com/advisories/deblts/debian-dla-4713-1-sslh
author: Security Arsenal
date: 2026/01/15
tags:
 - attack.initial_access
 - attack.t1190
logsource:
 category: process_creation
 product: linux
detection:
 selection:
 Image|endswith: '/sslh'
 condition: selection
falsepositives:
 - Legitimate sslh usage
level: informational

KQL (Microsoft Sentinel / Defender)

Use these queries to hunt for sslh activity in your environment via Syslog or CEF data, and to check for successful patching logs.

// Hunt for suspicious process spawns from sslh
DeviceProcessEvents
| where InitiatingProcessFileName == "sslh"
| where FileName in ("bash", "sh", "dash", "zsh", "python", "perl")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine
| order by Timestamp desc

// Check Syslog for Debian package management updates regarding sslh
Syslog
| where SyslogMessage contains "sslh"
| where ProcessName contains "dpkg" or ProcessName contains "apt"
| project TimeGenerated, Computer, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for the presence of the sslh binary and attempts to correlate it with the vulnerable package state by checking the file modification time against the advisory release date.

-- Hunt for sslh binaries and check recent modifications
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/*/{bin,sbin}/sslh")
WHERE Mtime < timestamp("2026-01-01")
  -- Flag if the binary hasn't been updated since before the fix

Remediation Script (Bash)

This script verifies the installed version of sslh, applies the security update from the Debian LTS repository, and restarts the service.

#!/bin/bash

# Remediation Script for CVE-2025-52936 (DLA-4713-1)
# Target: Debian 12 (Bookworm)

set -e

echo "[+] Checking for sslh installation..."
if ! dpkg -l | grep -q sslh; then
    echo "[-] sslh is not installed. No action required."
    exit 0
fi

echo "[+] Updating package lists..."
apt-get update -qq

echo "[+] Applying security patch for sslh (DLA-4713-1)..."
apt-get install --only-upgrade sslh -y

echo "[+] Verifying update..."
dpkg -l | grep sslh

echo "[+] Restarting sslh service to ensure the patched binary is active..."
systemctl restart sslh

echo "[+] Remediation complete. CVE-2025-52936 has been mitigated."

Remediation

To eliminate the risk posed by CVE-2025-52936, Security Arsenal recommends the following actions:

1. Update Immediately: Apply the patch released in Debian Security Advisory DLA-4713-1.

   • Command: sudo apt-get update && sudo apt-get install -y sslh
   • Fixed Version: Ensure the installed version is equal to or newer than the version specified in DLA-4713-1.

2. Verify Service Restart: Simply updating the binary is not enough if the vulnerable process remains in memory. Restart the service to load the patched version:

   • Command: sudo systemctl restart sslh

3. Verify Integrity: Check that the service is listening correctly:

   • Command: sudo systemctl status sslh

4. Review Local Logs: Inspect /var/log/auth.log for unauthorized local access attempts or suspicious sudo usage around the time of the patch release.

Official Advisory:

• Debian LTS DLA-4713-1

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub