CVE-2023-25136

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

CVSS v3.0 6.5 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig	Patch Vendor Advisory
https://bugzilla.mindrot.org/show_bug.cgi?id=3522	Exploit Issue Tracking Third Party Advisory
https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946	Patch Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/02/02/2	Exploit Mailing List Third Party Advisory
https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/	Exploit Third Party Advisory
https://news.ycombinator.com/item?id=34711565	Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/13/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/22/2	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/02/23/3	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/06/1	Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/03/09/2
https://security.netapp.com/advisory/ntap-20230309-0003/

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:openssh:openssh:9.1:*:*:*:*:*:*:*

Information

Published : 2023-02-02 22:15

Updated : 2023-03-09 11:15

NVD link : CVE-2023-25136

Mitre link : CVE-2023-25136

JSON object : View

CWE

CWE-415

Double Free

Advertisement

Products Affected

openssh

openssh

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig", "name": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://bugzilla.mindrot.org/show_bug.cgi?id=3522", "name": "https://bugzilla.mindrot.org/show_bug.cgi?id=3522", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "name": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "tags": ["Patch", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.openwall.com/lists/oss-security/2023/02/02/2", "name": "https://www.openwall.com/lists/oss-security/2023/02/02/2", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/", "name": "https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://news.ycombinator.com/item?id=34711565", "name": "https://news.ycombinator.com/item?id=34711565", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2023/02/13/1", "name": "[oss-security] 20230213 Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2023/02/22/1", "name": "[oss-security] 20230222 Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2023/02/22/2", "name": "[oss-security] 20230222 Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2023/02/23/3", "name": "[oss-security] 20230223 Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2023/03/06/1", "name": "[oss-security] 20230306 Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2023/03/09/2", "name": "[oss-security] 20230309 Re: Re: double-free vulnerability in OpenSSH server 9.1 (CVE-2023-25136)", "tags": [], "refsource": "MLIST"}, {"url": "https://security.netapp.com/advisory/ntap-20230309-0003/", "name": "https://security.netapp.com/advisory/ntap-20230309-0003/", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states \"remote code execution is theoretically possible.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-415"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2023-25136", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.2}}, "publishedDate": "2023-02-03T06:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openssh:openssh:9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-03-09T19:15Z"}