# CVE-2023-25136

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

- Page: https://www.vulneraibility.com/cve/CVE-2023-25136
- CVSS: 6.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 89.79% (percentile 99.8)
- Unvetted proof-of-concept code on GitHub: 11 GitHub proofs of concept (first 2023-02-07)
- CISA SSVC: exploitation poc, automatable no, technical impact partial (assessed 2024-02-27)
- Weakness: CWE-415
- Published: 2023-02-03

## Affected

- openbsd:openssh
- fedoraproject:fedora
- netapp:ontap_select_deploy_administration_utility
- netapp:a250_firmware
- netapp:500f_firmware
- netapp:c250_firmware

## References

- [other] https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig
- [other] https://www.openwall.com/lists/oss-security/2023/02/02/2
- [other] https://bugzilla.mindrot.org/show_bug.cgi?id=3522
- [other] https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946
- [other] https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/
- [other] https://news.ycombinator.com/item?id=34711565
- [other] http://www.openwall.com/lists/oss-security/2023/02/13/1
- [other] http://www.openwall.com/lists/oss-security/2023/02/22/1
- [other] http://www.openwall.com/lists/oss-security/2023/02/22/2
- [other] http://www.openwall.com/lists/oss-security/2023/02/23/3
- [other] http://www.openwall.com/lists/oss-security/2023/03/06/1
- [other] http://www.openwall.com/lists/oss-security/2023/03/09/2
- [other] https://security.netapp.com/advisory/ntap-20230309-0003/
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- [advisory] https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- [advisory] https://security.gentoo.org/glsa/202307-01
- [other] https://cert-portal.siemens.com/productcert/html/ssa-398330.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.