CVEvulnerability
CVE-2023-25136
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-02-03
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- Weaknesses
- CWE-415
Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Affected configurations
• openbsd openssh 9.1
• fedoraproject fedora 37
• fedoraproject fedora 38
• netapp ontap select deploy administration utility
• netapp a250 firmware
• netapp 500f firmware
• netapp c250 firmware
Related
Weakness · CWE (1)
- CWE-415 Double Free weakness
References
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List, Third Party Advisory
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit, Issue Tracking, Third Party Advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ lists.fedoraproject.org
- https://news.ycombinator.com/item?id=34711565 Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List, Third Party Advisory
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit, Issue Tracking, Third Party Advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ lists.fedoraproject.org
- https://news.ycombinator.com/item?id=34711565 Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit, Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com