CVE-2023-25136: Double Free
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kexalgorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSSH server (sshd)to a version that resolves this vulnerability.Fixed in 9.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenSSH server vulnerability?
The vulnerability ID for this OpenSSH server vulnerability is CVE-2023-25136.
What is the severity level of CVE-2023-25136?
The severity level of CVE-2023-25136 is medium with a CVSS score of 6.5.
Which version of OpenSSH server introduced this vulnerability?
OpenSSH server version 9.1 introduced this vulnerability.
Has this vulnerability been fixed in a later version of OpenSSH server?
Yes, this vulnerability has been fixed in OpenSSH server version 9.2.
Can an unauthenticated remote attacker exploit this vulnerability?
Yes, an unauthenticated remote attacker can exploit this vulnerability.