PT-2023-20163 · Unknown+6 · Gss-Ntlmssp+6

Philipturnbull · Published 2023-02-12 · Updated 2025-11-28 · CVE-2023-25565

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0

Description The issue is related to an incorrect free when decoding target information, which can trigger a denial of service. This occurs because the error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to be freed. The vulnerability can be triggered via the main gss accept sec context entry point, likely causing an assertion failure in free.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting the use of the gss accept sec context entry point until the update is applied.

Exploit

Fix

DoS

Weakness Enumeration

CWE-763

CWE-590

Related Identifiers

ALSA-2023:3097

AZL-43606

AZL-45279

BDU:2025-12444

CESA-2023_3097

CVE-2023-25565

GHSA-7Q7F-WQCG-MVFG

MGASA-2023-0108

OESA-2023-1116

OPENSUSE-SU-2023:0048-1

OPENSUSE-SU-2024:12701-1

RHSA-2023:3097

RHSA-2023_3097

USN-7588-1

Affected Products

Almalinux

Centos

Debian

Gss-Ntlmssp

Linuxmint

Red Hat

Ubuntu

References · 54

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25565.json · Exploit
• https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25567 · Security Note
• https://advisories.mageia.org/MGASA-2023-0108.html · Security Note
• https://osv.dev/vulnerability/USN-7588-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-3097.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:3097 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-25564 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-25565 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12444 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-25565 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-25565 · Security Note
• https://ubuntu.com/security/CVE-2023-25567 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2023-25565 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2023-3097.html · Vendor Advisory