⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2023-25136 — Double Free in Openssh
CWE-415 — Double FreeCWE-401 — Missing Release of Memory after Effective Lifetime11 documents10 sources
Severity
6.5MEDIUMNVD
EPSS
88.3%
top 0.50%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedFeb 3
Latest updateApr 15
Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HExploitability: 2.2 | Impact: 4.2
Affected Packages2 packages
Also affects: Fedora 37, 38
Patches
🔴Vulnerability Details
3📋Vendor Advisories
5Oracle
▶
Microsoft▶
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote at↗2023-02-14
Red Hat▶
openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability↗2023-02-03
Debian▶
CVE-2023-25136: openssh - OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options....↗2023