OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote a…
Medium CVSS 6.5
Summary
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- https://news.ycombinator.com/item?id=34711565 Issue Tracking
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- https://news.ycombinator.com/item?id=34711565 Issue Tracking
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Timeline
- nvd_ingest NVD