CVE-2023-25136CWE-415

CVE-2023-25136

Medium · published February 3, 2023

Patch now

High probability of exploitation

CVSS calls it medium at 6.5. It sits in the 99.8th percentile for exploit probability.

CVSS v3.1
6.5
EPSS
90%
Percentile
99.8
In the wild
Unconfirmed
What it is

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.89792 · 99.8th percentile
Weakness
CWE-415 · Double Free
Published
2023-02-03T11:15Z
Affected products (7)
ProductVersionsFixed in
openbsd/opensshall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
netapp/ontap_select_deploy_administration_utilityall versions—
netapp/a250_firmwareall versions—
netapp/500f_firmwareall versions—
netapp/c250_firmwareall versions—
References (33)
http://www.openwall.com/lists/oss-security/2023/02/13/1 · [email protected]http://www.openwall.com/lists/oss-security/2023/02/22/1 · [email protected]http://www.openwall.com/lists/oss-security/2023/02/22/2 · [email protected]http://www.openwall.com/lists/oss-security/2023/02/23/3 · [email protected]http://www.openwall.com/lists/oss-security/2023/03/06/1 · [email protected]http://www.openwall.com/lists/oss-security/2023/03/09/2 · [email protected]https://bugzilla.mindrot.org/show_bug.cgi?id=3522 · [email protected]https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig · [email protected]https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 · [email protected]https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ · [email protected]https://news.ycombinator.com/item?id=34711565 · [email protected]https://security.gentoo.org/glsa/202307-01 · [email protected]https://security.netapp.com/advisory/ntap-20230309-0003/ · [email protected]https://www.openwall.com/lists/oss-security/2023/02/02/2 · [email protected]http://www.openwall.com/lists/oss-security/2023/02/13/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/02/22/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/02/22/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/02/23/3 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/03/06/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/03/09/2 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.mindrot.org/show_bug.cgi?id=3522 · af854a3a-2127-422b-91ae-364da2661108https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig · af854a3a-2127-422b-91ae-364da2661108https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 · af854a3a-2127-422b-91ae-364da2661108https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ · af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=34711565 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202307-01 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230309-0003/ · af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2023/02/02/2 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 03 FEB 00:00Z
    OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling
    cvelistv5