OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
[POC] CVE-2023-25136 — CVE-2023-25136
OpenSSH 9.1 vulnerability mass scan and exploit
[POC] CVE-2023-25136 — CVE-2023-25136
OpenSSH 9.1 vulnerability mass scan and exploit
[POC] CVE-2023-25136 — CVE-2023-25136
Looking into the memory when sshd 9.1p1 aborts due to a double free bug.
[POC] CVE-2023-25136 — CVE-2023-25136
OpenSSH 9.1漏洞大规模扫描和利用
[POC] CVE-2023-25136 — CVE-2023-25136
This vulnerability is of the "double-free" type, which occurs during the processing of key exchange (KEX) algorithms in OpenSSH. A "double-free" vulnerability happens when memory that has already been freed is freed again. This issue can indirectly lead to remote code execution (RCE) by an attacker.
[POC] CVE-2023-25136 — CVE-2023-25136
OpenSSH Pre-Auth Double Free CVE-2023-25136 POC
[POC] CVE-2023-25136 — CVE-2023-25136_POC
CVE-2023-25136 POC written by axylisdead
[POC] CVE-2023-25136 — CVE-2023-25136
OpenSSH Pre-Auth Double Free CVE-2023-25136 – Writeup and Proof-of-Concept
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free