PT-2023-1368 · Openssh+5 · Openssh+5

Mantas Mikulenas · Published 2023-02-02 · Updated 2026-04-09 · CVE-2023-25136

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenSSH versions 9.1 through 9.1

Description The issue is related to a double-free vulnerability in the options.kex algorithms handling of the OpenSSH server. This vulnerability can be leveraged by an unauthenticated remote attacker in the default configuration to potentially execute arbitrary code. The vulnerability is considered difficult to exploit due to modern memory allocators' protective measures and the separation of privileges and sandboxing implemented in the sshd process.

Recommendations For OpenSSH version 9.1, update to OpenSSH 9.2 to resolve the issue. As a temporary workaround, consider restricting access to the options.kex algorithms handling until a patch is available.

Exploit

Fix

RCE

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALSA-2023:2645

ALSA-2023_2645

ALSA-2024_1130

ALSA-2024_1150

ALSA-2025_16880

ALT-PU-2024-3921

ALT-PU-2024-4077

ALT-PU-2024-4467

ALT-PU-2024-9513

BDU:2023-00711

CVE-2023-25136

ELSA-2023-2645

FREEBSD-SA-23_02

JLSEC-2026-66

OESA-2023-1063

OESA-2023-1064

RHSA-2023:2645

RHSA-2023_2645

ROSA-SA-2023-2127

Affected Products

Alt Linux

Almalinux

Astra Linux

Freebsd

Openssh

Red Hat

References · 67

• 🔥 https://github.com/Christbowel/CVE-2023-25136 · Exploit
• 🔥 https://github.com/adhikara13/CVE-2023-25136 · Exploit
• 🔥 https://github.com/jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free · Exploit
• 🔥 https://github.com/nhakobyan685/CVE-2023-25136 · Exploit
• 🔥 https://github.com/H4K6/CVE-2023-25136 · Exploit
• 🔥 https://github.com/axylisdead/CVE-2023-25136_POC · Exploit
• 🔥 https://github.com/ticofookfook/CVE-2023-25136 · Exploit
• 🔥 https://github.com/malvika-thakur/CVE-2023-25136 · Exploit
• 🔥 https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept · Exploit
• 🔥 https://openwall.com/lists/oss-security/2023/02/02/2 · Exploit
• 🔥 https://bugzilla.mindrot.org/show_bug.cgi?id=3522 · Exploit
• https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 · Patch
• https://osv.dev/vulnerability/CVE-2023-25136 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00711 · Security Note