CVE-2023-25136

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 89.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-02-03 · updated 2026-10-14
Weakness: CWE-415

Description

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Affected products

Fedoraproject Fedora: 37, 38
NetApp 500F Firmware: all versions
NetApp A250 Firmware: all versions
NetApp C250 Firmware: all versions
NetApp ONTAP Select Deploy administration utility: all versions
OpenSSH: 9.1

References

http://www.openwall.com/lists/oss-security/2023/02/13/1
http://www.openwall.com/lists/oss-security/2023/02/22/1
http://www.openwall.com/lists/oss-security/2023/02/22/2
http://www.openwall.com/lists/oss-security/2023/02/23/3
http://www.openwall.com/lists/oss-security/2023/03/06/1
http://www.openwall.com/lists/oss-security/2023/03/09/2
https://bugzilla.mindrot.org/show_bug.cgi?id=3522
https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig
https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946
https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/

Get alerted when CVE-2023-25136 or the next vulnerability affects your stack