OpenSSH versions prior to 10.3 contain a vulnerability (CWE-281) related to improper preservation of file permissions during scp file transfers using the legacy protocol (-O) when executed as root without the -p option. Specifically, downloaded files may inadvertently be installed with setuid or setgid bits set, potentially allowing privilege escalation. This issue arises from the failure to correctly handle file mode preservation in this specific scenario. Red Hat has released security advisories and updates to fix this vulnerability in their supported OpenSSH packages.

The vulnerability allows a file downloaded by scp under the specified conditions to be installed with elevated permissions (setuid or setgid), which can lead to privilege escalation on the affected system. This may enable an attacker or user to gain unauthorized elevated privileges, compromising system security. The CVSS v3.1 base score is 7.5, indicating a high impact on confidentiality, integrity, and availability.

Red Hat has issued security advisories and patches that address this vulnerability. Users should apply the official OpenSSH updates provided by their vendor, such as those in Red Hat Enterprise Linux Extended Life Cycle Support Extension 6. The advisories and errata linked provide instructions for updating. Until patched, avoid using scp with the legacy protocol (-O) as root without the -p option to prevent unintended setuid/setgid file installations. Patch status is confirmed via vendor advisories; applying these updates mitigates the vulnerability.