A medium-severity vulnerability, identified as CVE-2023-25136, has been discovered in OpenSSH server (sshd) version 9.1, affecting various systems running this version. The vulnerability is a double-free issue that can be exploited by an unauthenticated remote attacker, although it is considered difficult to exploit due to modern memory allocators' protections and the fact that the impacted sshd process is unprivileged and heavily sandboxed. The vulnerability has been fixed in OpenSSH 9.2, and affected systems include OpenBSD, Fedora Project Fedora, and NetApp firmware.

How do I know if I'm affected?

If you're using OpenSSH server 9.1, you might be affected by the cve-2023-25136 vulnerability. This issue is particularly relevant for systems running OpenBSD 7.2, Fedora 37 and 38, and certain NetApp firmware versions. To know if you're affected, check if your system is running the mentioned OpenSSH version. Keep in mind that exploiting this vulnerability is considered difficult due to modern memory allocators' protections and the fact that the impacted sshd process is unprivileged and heavily sandboxed.

What should I do if I'm affected?

If you're affected by this vulnerability, it's important to update your OpenSSH server to version 9.2 or later, as this version contains a fix for the issue. For non-technical users, it's best to consult with your IT administrator or seek professional assistance to ensure a smooth and secure update process.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-25136 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This double-free issue in OpenSSH server 9.1 has been fixed in version 9.2. Although exploiting the vulnerability is considered difficult, it's important to update your system to mitigate potential risks. No specific date or due date is provided for this vulnerability, but updating to OpenSSH 9.2 or later is the recommended action.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-415 is a double-free issue in OpenSSH server 9.1, which can lead to an information leak but is difficult to exploit. It affects OpenBSD amd64 systems and is not confirmed for GNU/Linux yet.

For more details

For a comprehensive understanding of the vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page and the resources listed below.

• Qualys Security Advisory on oss-security

• In-depth analysis of the exploitation on OpenBSD

• Discussion on the limitations of the attack and information leak

• Email thread on the possibility of bypassing ASLR and exploitability on GNU/Linux