Double Free in OpenSSH - CVE-2023-25136

Vulnerability identifier: #VU71771

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25136

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to potentially execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the sshd(8) daemon. A remote non-authenticated attacker can send  specially crafted data to the application, trigger a double free error and execute arbitrary code on the target system.

The vendor believes exploitation of this vulnerability has limitations as double free occurs "in the unprivileged pre-auth process that is subject to chroot(2) and is further sandboxed on most major platforms". Nevertheless we assign a high risk to this vulnerability.

OpenSSH
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
FreeBSD
Slackware Linux
openEuler
Anolis OS
Fedora
Oracle Healthcare Translational Research
Red Hat OpenShift Container Platform
pam_ssh_agent_auth
openssh (Red Hat package)
openssh
openssh-askpass
openssh-clients
openssh-keycat
openssh-server
openssh-doc
OpenShift Data Foundation (formerly OpenShift Container Storage)
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift

Install updates from vendor's website.

OpenSSH - update to 9.2p1
Red Hat OpenShift Container Platform - update to 4.13.2
pam_ssh_agent_auth - addressed in versions 0.10.4-4.16, 0.10.4-4.17, 0.10.4-4.18
pam_ssh_agent_auth - update to 0.10.4-7.9
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
openssh (Red Hat package) - update to 8.7p1-29.el9_2
openssh - addressed in versions 8.8p1-10.fc37, 9.0p1-15.fc38
openssh - update to 9.0p1-9
openssh-askpass - update to 9.0p1-9
openssh-clients - update to 9.0p1-9
openssh-keycat - update to 9.0p1-9
openssh-server - update to 9.0p1-9
openssh-doc - update to 9.0p1-9
openssh - update to 9.2p1
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.4
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.4

• Exploit #10240 - CVE-2023-25136 (OpenSSH 9.1漏洞大规模扫描和利用) (July 26, 2024)
• Exploit #9019 - CVE-2023-25136 (OpenSSH 9.1 vulnerability mass scan and exploit) (April 30, 2023)
• Exploit #8865 - CVE-2023-25136 (OpenSSH 9.1 vulnerability mass scan and exploit) (February 23, 2023)

• https://www.openssh.com/releasenotes.html#9.2
• https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946
• https://bugzilla.mindrot.org/show_bug.cgi?id=3522

• Multiple vulnerabilities in OpenSSH
• Slackware Linux update for openssh
• FreeBSD update for OpenSSH
• Multiple vulnerabilities in Oracle Healthcare Translational Research
• Red Hat Enterprise Linux 9 update for openssh
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Gentoo update for OpenSSH
• Fedora 38 update for openssh
• Fedora 37 update for openssh
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• Multiple vulnerabilities in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• openEuler 22.03 LTS update for openssh
• openEuler 22.03 LTS SP1 update for openssh
• Anolis OS update for openssh