Published: 03/02/2023 Updated: 27/02/2024

CVSS v3 Base Score: 6.5 | Impact Score: 4.2 | Exploitability Score: 2.2

VMScore: 0

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Vulnerable Product	Search on Vulmon	Subscribe to Product
openbsd openssh 9.1
fedoraproject fedora 37
fedoraproject fedora 38
netapp ontap select deploy administration utility -
netapp a250_firmware -
netapp 500f_firmware -
netapp c250_firmware -

Synopsis Important: Red Hat OpenShift Data Foundation 4130 security and bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4130 on Red Hat Enterprise Linux 9Red Hat ...

Synopsis Important: OpenShift Container Platform 4132 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 4132 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift C ...

DescriptionA flaw was found in the OpenSSH server (sshd), which introduced a double-free vulnerability during optionskex_algorithms handling An unauthenticated attacker can trigger the double-free in the default configurationA flaw was found in the OpenSSH server (sshd), which introduced a double-free vulnerability during optionskex_algo ...

pre-authentication double-free in unpriviledged sandboxed client process when the connecting clients banner causes the SSH_OLD_DHGEX to be set on the server ...

Critical Infrastructure Sectors: Critical Manufacturing

CVE-2023-25136 Proof-of-Concept Overview This is a DoS Proof-of-Concept of OpenSSH 91p1 Double-Free Vulnerability CVE-2023-25136 It will trigger the double-free and cause an abort crash For a comprehensive understanding, check out the accompanying blog post for in-depth details Dependencies Python 36+ paramiko Python Library Usage Verify paramiko is installed: pip inst

OpenSSH Pre-Auth Double Free CVE-2023-25136 POC

OpenSSH Pre-Auth Double Free CVE-2023-25136 POCThis repository contains a Proof of Concept (POC) script to check for the OpenSSH Pre-Auth Double Free vulnerability (CVE-2023-25136) using the Paramiko library in PythonPrerequisitesBefore running this POC script, you need to make sure you have the following dependencies installed:Python 3xParamiko librarytermcolor libraryargpar

OpenSSH 9.1漏洞大规模扫描和利用

CVE-2023-25136 OpenSSH 91漏洞大规模扫描和利用 *脆弱性的详细信息 OpenSSH是一种实现SSH协议的软件，通常用于以安全的方式连接到Linux（或Windows）机器以执行远程管理。 OpenSSH 91中引入的CVE-2023-25136安全漏洞影响SSH预身份验证过程。通过利用它，攻击者可以破坏内存并在机器上执行任意代码，

OpenSSH 9.1 vulnerability mass scan and exploit

CVE-2023-25136 OpenSSH 91 vulnerability mass scan and exploit Description OpenSSH server (sshd) 91 introduced a double-free vulnerability during optionskex_algorithms handling This is fixed in OpenSSH 92 The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space One third-party r

CVE-2023-25136 Proof-of-Concept Overview This is a DoS Proof-of-Concept of OpenSSH 91p1 Double-Free Vulnerability CVE-2023-25136 It will trigger the double-free and cause an abort crash For a comprehensive understanding, check out the accompanying blog post for in-depth details Dependencies Python 36+ paramiko Python Library Usage Verify paramiko is installed: pip inst

OpenSSH Pre-Auth Double Free CVE-2023-25136 – Writeup and Proof-of-Concept

OpenSSH (CVE-2023-25136) Pre-Auth Double Free – Writeup and POC What is OpenSSH? OpenSSH is a popular tool used for secure communication and remote access It was developed as a free, open-source implementation of the Secure Shell (SSH) communications protocol and is widely used for various applications OpenSSH provides a secure and encrypted connection between two untru

OpenSSH 9.1 vulnerability mass scan and exploit

CVE-2023-25136 OpenSSH 91 vulnerability mass scan and exploit Détails sur la vulnérabilité Pour rappel, OpenSSH est un logiciel qui implémente le protocole SSH, très fréquemment utilisé pour se connecter à des machines sous Linux (ou Windows) de façon sécurisée pour effectuer de l'administration

Looking into the memory when sshd 9.1p1 aborts due to a double free bug.

CVE-2023-25136 Looking into the memory when sshd 91p1 aborts due to a double free bug The pdf has some images that are rather blurry I will update it soon for better legibility

CVE-2023-25136 POC written by axylisdead

CVE-2023-25136 POC POC For A Pre Auth Double Free Vulnerability Affecting OpenSSH 91 To 92 Neccessary libraries Please make sure you have the following dependencies installed: Python 3 (duh) termcolor argparse fabric You can also install these libraries directly from the included requirementstxt file using pip python3 -m pip install -r requirementstxt How to use: To us

CVE-2023-25136 OpenSSH 91 vulnerability mass scan and exploit Description OpenSSH server (sshd) 91 introduced a double-free vulnerability during optionskex_algorithms handling This is fixed in OpenSSH 92 The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space One third-party r

CWE-415 https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig https://bugzilla.mindrot.org/show_bug.cgi?id=3522 https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 https://www.openwall.com/lists/oss-security/2023/02/02/2 https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/https://news.ycombinator.com/item?id=34711565 http://www.openwall.com/lists/oss-security/2023/02/13/1 http://www.openwall.com/lists/oss-security/2023/02/22/1 http://www.openwall.com/lists/oss-security/2023/02/22/2 http://www.openwall.com/lists/oss-security/2023/02/23/3 http://www.openwall.com/lists/oss-security/2023/03/06/1 http://www.openwall.com/lists/oss-security/2023/03/09/2 https://security.netapp.com/advisory/ntap-20230309-0003/https://security.gentoo.org/glsa/202307-01 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:3742 https://github.com/adhikara13/CVE-2023-25136 https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10 https://access.redhat.com/security/cve/cve-2023-25136

CVE-2023-25136

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect