OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
Fix
Public exploits 11
- Business1sg00d/CVE-2023-25136 PoC on GitHub
- Christbowel/CVE-2023-25136 PoC on GitHub
- H4K6/CVE-2023-25136 PoC on GitHub
- Lane0218/CVE-2023-25136-PoC PoC on GitHub
- adhikara13/CVE-2023-25136 PoC on GitHub
- axylisdead/CVE-2023-25136_POC PoC on GitHub
- jfrog/jfrog-CVE-2023-25136-OpenSSH_Double-Free PoC on GitHub
- malvika-thakur/CVE-2023-25136 PoC on GitHub
- mrmtwoj/CVE-2023-25136 PoC on GitHub
- nhakobyan685/CVE-2023-25136 PoC on GitHub
- ticofookfook/CVE-2023-25136 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 4
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · openbsd, fedoraproject, netappNVD modified 2026-10-14 23:17
Affected (CPE criteria) 7
cpe:2.3:a:openbsd:openssh:9.1:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
References 33
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List, Third Party Advisory
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit, Issue Tracking, Third Party Advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- https://news.ycombinator.com/item?id=34711565 Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit, Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/13/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/22/2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/02/23/3 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/06/1 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/03/09/2 Mailing List, Third Party Advisory
- https://bugzilla.mindrot.org/show_bug.cgi?id=3522 Exploit, Issue Tracking, Third Party Advisory
- https://ftp.openbsd.org/pub/OpenBSD/patches/7.2/common/017_sshd.patch.sig Patch, Vendor Advisory
- https://github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946 Patch, Third Party Advisory
- https://jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/ Exploit, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JGAUIXJ3TEKCRKVWFQ6GDAGQFTIIGQQP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7LKQDFZWKYHQ65TBSH2X2HJQ4V2THS3/
- https://news.ycombinator.com/item?id=34711565 Issue Tracking, Third Party Advisory
- https://security.gentoo.org/glsa/202307-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230309-0003/ Third Party Advisory
- https://www.openwall.com/lists/oss-security/2023/02/02/2 Exploit, Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html