lane0218/cve-2023-25136-pocMinimal Docker-based reproduction environment for OpenSSH 9.1p1 pre-auth double-free vulnerability (CVE-2023-25136), demonstrating memory corruption and denial-of-service via a Python PoC client.
This project provides a minimal local experimental environment for reproducing the OpenSSH 9.1p1 pre-authentication double free memory corruption vulnerability (CVE-2023-25136) and observing the server process crash (DoS) effect.
Note: Official and mainstream analyses generally consider this vulnerability "difficult to actually exploit for remote code execution" under default security configurations. This environment is primarily used to demonstrate memory errors and denial-of-service effects.
Target:
sshd configured--with-sandbox=no to disable the seccomp sandbox22 inside the container, mapped to port 2222 on the host (WSL)Attacker:
paramiko to run the PoC, crafting a specific SSH client identifier and initiating a pre-authentication handshakeDirectory structure:
Dockerfile: Builds an image with the OpenSSH 9.1p1 vulnerable environmentpoc.py: Minimal PoC client for triggering the pre-authentication double freeBefore performing the following operations in this directory, ensure:
pip are installedExecute in this directory:
docker build -t sshd-9.1p1-vuln .
docker run --rm -d --name sshd-vuln -p 2222:22 sshd-9.1p1-vuln
Explanation:
--rm: Automatically remove the container when it exits--name sshd-vuln: Container name-p 2222:22: Maps port 22 in the container to port 2222 on the hostdocker ps
You should see output similar to:
CONTAINER ID IMAGE COMMAND STATUS PORTS
xxxxxx sshd-9.1p1-vuln "/usr/sbin/sshd -D…" Up ... 0.0.0.0:2222->22/tcp
Execute in this directory:
pip install paramiko
poc.py uses paramiko.Transport to actively establish a connection with the target SSH server, faking a client identifier during the pre-authentication phase in an attempt to trigger a double free.
Key features:
127.0.0.1:2222 (the local Docker container)SSH-2.0-PuTTY_Release_0.64-t/--target: Target IP (default 127.0.0.1)-p/--port: Target port (default 2222)-c/--client-id: Fake SSH client identifier--timeout: Timeout in seconds-v/--verbose: Print detailed error informationWith the container sshd-vuln running, execute in this directory:
python3 poc.py
Or explicitly specify parameters:
python3 poc.py -t 127.0.0.1 -p 2222 -v
Expected client output example:
==============================================
CVE-2023-25136 OpenSSH Pre-Auth Double Free
Minimal PoC Client
==============================================
[2024-xx-xx xx:xx:xx] Target: 127.0.0.1:2222, ClientID: SSH-2.0-PuTTY_Release_0.64
[+] Sending crafted pre-auth handshake...
[-] Authentication failed or connection closed early.
Check the server sshd logs for 'free(): double free detected' or similar messages to confirm whether CVE-2023-25136 was triggered.
Explanation:
Authentication failed or connection closed here is expected, because the server's pre-authentication child process may crash or actively close the connection during processing.After running the PoC, view the container logs on the host:
docker logs sshd-vuln
Expected output similar to:
Server listening on 0.0.0.0 port 22.
Server listening on :: port 22.
Invalid user from 172.17.0.1 port xxxxx
free(): double free detected in tcache 2
Where:
Invalid user: Because the PoC uses an empty username, OpenSSH logs an invalid user attemptfree(): double free detected in tcache 2: glibc detects a double free and terminates the current sshd child process. This is the memory corruption/DoS phenomenon we aim to observe.Note: To be able to see this line, we built OpenSSH with seccomp sandbox disabled (
--with-sandbox=no); otherwise, the sandbox might intercept the anomalous behavior and terminate the child process before the double free occurs.
sshd process will continue to fork new child processes for subsequent connections.