OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
{ "vanir_signatures": [ { "digest": { "function_hash": "118456307265918822993183845344807249614", "length": 753.0 }, "id": "CVE-2023-25136-0ab7c60f", "source": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "signature_type": "Function", "signature_version": "v1", "target": { "file": "compat.c", "function": "compat_kex_proposal" }, "deprecated": false }, { "digest": { "function_hash": "76943240051596031711763984993421529394", "length": 424.0 }, "id": "CVE-2023-25136-3787b0b6", "source": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "signature_type": "Function", "signature_version": "v1", "target": { "file": "compat.c", "function": "compat_pkalg_proposal" }, "deprecated": false }, { "digest": { "function_hash": "212652943476130378868419676907070987021", "length": 410.0 }, "id": "CVE-2023-25136-5bfc610e", "source": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "signature_type": "Function", "signature_version": "v1", "target": { "file": "compat.c", "function": "compat_cipher_proposal" }, "deprecated": false }, { "digest": { "threshold": 0.9, "line_hashes": [ "83589648752989715290650839198962214645", "329892068102067720888341098580298123240", "177513386508925729136292818796922213857", "339340910026144685107970787261715577635", "144018939557174605213828025937930135706", "173484486965340709052335623819764218732", "304700631074823457646957735684415154705", "227538380910095194226395460534480552986", "192948405723392404346714349161667096097", "9469493054080965994529429256762026878", "55188678287755430717836321076827298802", "281306935055482112900686618738551136782", "216438549429403703874566747418195123379", "180466277492941068128384735429005176493", "273709931733691172226080345985406181316", "116864435953437300469249507779935097202", "238791531932518523761084853534844702814", "190140884886759192188872546577334219689", "221429695535509130649978337450787482814", "269395615482261015947544781182831685041", "208251565582124202052792082760227312504", "302057517542619678387050950185058444428", "203752864320362965429535529904730333242", "276292056983437343675349764124793772527", "284237610092287733290793395964254761342", "242474690308998079289439629701806681948", "125131897871234561664724868045677876590", "216868530349156713089042009209821144852", "122255777631083949403368615143220046131", "283912275984244290683230643655027005835", "325790611851037684331376571066811609028", "305703836663070734070295053392197759849", "14438550667141083691881287657591393461", "5623584408971955288840573407479474433", "109709693131126739710122319347800082964" ] }, "id": "CVE-2023-25136-d9013154", "source": "https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946", "signature_type": "Line", "signature_version": "v1", "target": { "file": "compat.c" }, "deprecated": false } ] }