CVE-2023-25136

2023-02-0300:00:00

ubuntu.com

222

openssh server

double-free vulnerability

kex_algorithms handling

remote code execution

ubuntu

bug 3522

compatibility

security support

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

0.009 Low

EPSS

Percentile

82.6%

JSON

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during
options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double
free can be leveraged, by an unauthenticated remote attacker in the default
configuration, to jump to any location in the sshd address space. One
third-party report states “remote code execution is theoretically
possible.”

Bugs

<https://bugzilla.mindrot.org/show_bug.cgi?id=3522>

Notes

Author	Note
seth-arnold	openssh-ssh1 is provided for compatibility with old devices that cannot be upgraded to modern protocols. Thus we may not provide security support for this package if doing so would prevent access to equipment.
rodrigo-zaiden	issue introduced in OpenSSH 9.1, hence, not affecting any current Ubuntu releases. The commit that introduced the issue is 486c4dc3b83b4b67d663fb0fa62bc24138ec3946.