CVE-2023-25136: Double Free
Published Feb 3, 2023
·Updated
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Affected Software
19 affected componentsFixes available
OpenSSH OpenSSH=9.1
Fedoraproject Fedora=37
Fedoraproject Fedora=38
NetApp ONTAP Select Deploy administration utility
NetApp A250 Firmware
NetApp A250
NetApp 500f Firmware
NetApp 500f
NetApp C250 Firmware
NetApp C250
OpenBSD OpenSSH=9.1
All of the following
NetApp A250 Firmware
NetApp A250
All of the following
NetApp 500f Firmware
NetApp 500f
All of the following
NetApp C250 Firmware
NetApp C250
Microsoft cbl2 openssh 8.9p1-8
Microsoft cm1 openssh 8.9p1-3
Remediation
Event History
Feb 3, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 1, 2025
Data Sourced
via Microsoft·11:11 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·11:11 PM
Affected Software
Updated
via Microsoft·11:11 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID for this OpenSSH server vulnerability?
The vulnerability ID for this OpenSSH server vulnerability is CVE-2023-25136.
2
What is the severity level of CVE-2023-25136?
The severity level of CVE-2023-25136 is medium with a CVSS score of 6.5.
3
Which version of OpenSSH server introduced this vulnerability?
OpenSSH server version 9.1 introduced this vulnerability.
4
Has this vulnerability been fixed in a later version of OpenSSH server?
Yes, this vulnerability has been fixed in OpenSSH server version 9.2.
5
Can an unauthenticated remote attacker exploit this vulnerability?
Yes, an unauthenticated remote attacker can exploit this vulnerability.