CVE-2023-25136

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25136
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List Third Party Advisory
https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit Issue Tracking Third Party Advisory
https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch Vendor Advisory
https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch Third Party Advisory
https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
https://news.ycombinator.com/item?id=34711565 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202307-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List Third Party Advisory
https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit Issue Tracking Third Party Advisory
https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch Vendor Advisory
https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch Third Party Advisory
https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
https://news.ycombinator.com/item?id=34711565 Issue Tracking Third Party Advisory
https://security.gentoo.org/glsa/202307-01 Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openbsd:openssh:9.1:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
History

21 Nov 2024, 07:49

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2023/02/13/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/02/13/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/02/22/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/02/22/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/02/22/2 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/02/22/2 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/02/23/3 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/02/23/3 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/03/06/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/03/06/1 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2023/03/09/2 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2023/03/09/2 - Mailing List, Third Party Advisory
References () https://bugzilla.mindrot.org/show_bug.cgi?id=3522 - Exploit, Issue Tracking, Third Party Advisory () https://bugzilla.mindrot.org/show_bug.cgi?id=3522 - Exploit, Issue Tracking, Third Party Advisory
References () https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig - Patch, Vendor Advisory () https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig - Patch, Vendor Advisory
References () https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 - Patch, Third Party Advisory () https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 - Patch, Third Party Advisory
References () https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ - Exploit, Third Party Advisory () https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/ -
References () https://news.ycombinator.com/item?id=34711565 - Issue Tracking, Third Party Advisory () https://news.ycombinator.com/item?id=34711565 - Issue Tracking, Third Party Advisory
References () https://security.gentoo.org/glsa/202307-01 - Third Party Advisory () https://security.gentoo.org/glsa/202307-01 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20230309-0003/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230309-0003/ - Third Party Advisory
References () https://www.openwall.com/lists/oss-security/2023/02/02/2 - Exploit, Mailing List, Third Party Advisory () https://www.openwall.com/lists/oss-security/2023/02/02/2 - Exploit, Mailing List, Third Party Advisory

27 Feb 2024, 15:15

Type Values Removed Values Added
First Time Openbsd
Openbsd openssh
CPE cpe:2.3:a:openssh:openssh:9.1:*:*:*:*:*:*:* cpe:2.3:a:openbsd:openssh:9.1:*:*:*:*:*:*:*
Information

Published : 2023-02-03 06:15

Updated : 2024-11-21 07:49

NVD link : CVE-2023-25136

Mitre link : CVE-2023-25136

CVE.ORG link : CVE-2023-25136

JSON object : View

Products Affected

netapp

  • a250_firmware
  • ontap_select_deploy_administration_utility
  • 500f_firmware
  • c250_firmware
  • c250
  • a250
  • 500f

fedoraproject

  • fedora

openbsd

  • openssh
CWE
CWE-415

Double Free