6.5

CVE-2023-25136

Exploit

OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openbsd ≫ Openssh Version9.1
Fedoraproject ≫ Fedora Version37
Fedoraproject ≫ Fedora Version38
Netapp ≫ A250 Firmware Version-
   Netapp ≫ A250 Version-
Netapp ≫ 500f Firmware Version-
   Netapp ≫ 500f Version-
Netapp ≫ C250 Firmware Version-
   Netapp ≫ C250 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 90.54% 0.996
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.2 4.2
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-415 Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

https://bugzilla.mindrot.org/show_bug.cgi?id=3522
Third Party Advisory
Exploit
Issue Tracking
https://news.ycombinator.com/item?id=34711565
Third Party Advisory
Issue Tracking
https://www.openwall.com/lists/oss-security/2023/02/02/2
Third Party Advisory
Exploit
Mailing List