CVE-2023-25136: fedoraproject fedora Double Free
Vulnerability summary
CVE-2023-25136 is a medium (CVSS 6.5) Double Free vulnerability in fedoraproject fedora. EPSS estimates a 89.69% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 03-02-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. This is fixed in OpenSSH 9.2. The double free can be leveraged, by an unauthenticated remote attacker in the default configuration, to jump to any location in the sshd address space. One third-party report states "remote code execution is theoretically possible."
CVSS metrics
4 scores · 4 sources · 1 version- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS trend
Probability
89.69%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 89.69% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (bugzilla.mindrot.org)
Maturity: unknown
Exploit Reference (jfrog.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat14 products
- openssh< 0:8.7p1-29.el9_2
- openssh-askpass< 0:8.7p1-29.el9_2
- openssh-askpass-debuginfo< 0:8.7p1-29.el9_2
- openssh-clients< 0:8.7p1-29.el9_2
- openssh-clients-debuginfo< 0:8.7p1-29.el9_2
Netapp4 products
Chainguard1 product
- openssh< 9.2_p1-r0
Debian1 product
- openssh< 1:9.2p1-1
Fedoraproject1 product
- fedoraEOL37 | 38
Openbsd1 product
- openssh9.1
Ubuntu1 product
- opensshAll versions (No fix recorded)
Wolfi1 product
- openssh< 9.2_p1-r0
8 vendors · 24 products
References
27 links- www.openwall.com/lists/oss-security/2023/02/02/2ARTICLEREPORTExploitMailing ListThird Party Advisory
- github.com/openssh/openssh-portable/commit/486c4dc3b83b4b67d663fb0fa62bc24138ec3946ARTICLEPatchThird Party Advisory
- jfrog.com/blog/openssh-pre-auth-double-free-cve-2023-25136-writeup-and-proof-of-concept/REPORTExploitThird Party Advisory
Show all 27 references
- security.netapp.com/advisory/ntap-20230309-0003/Third Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
