CVE-2023-25136

MEDIUM 6.5CVE-2023-25136 · Published 03/02/2023 · updated 14/10/2026

Package	Affected versions	Patched versions
openssh openbsd	`= 9.1`	No fix yet

Description

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

References

openwall.com/lists/oss-security/2023/02/13/1 · Mailing List
openwall.com/lists/oss-security/2023/02/22/1 · Mailing List
openwall.com/lists/oss-security/2023/02/22/2 · Mailing List
openwall.com/lists/oss-security/2023/02/23/3 · Mailing List
openwall.com/lists/oss-security/2023/03/06/1 · Mailing List
openwall.com/lists/oss-security/2023/03/09/2 · Mailing List
bugzilla.mindrot.org/show_bug.cgi · Exploit
ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig · Patch
openssh/openssh-portable commit 486c4dc · Patch
jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept · Exploit
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3
news.ycombinator.com/item · Issue Tracking
security.gentoo.org/glsa/202307-01 · Third Party Advisory
security.netapp.com/advisory/ntap-20230309-0003 · Third Party Advisory
openwall.com/lists/oss-security/2023/02/02/2 · Exploit
cert-portal.siemens.com/productcert/html/ssa-398330.html

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free