CVE-2023-51767

CVE-2023-51767

High · published December 24, 2023

CVSS v3.1
7.0
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Published
2023-12-24T12:15Z
Affected products (4)
ProductVersionsFixed in
openbsd/opensshall versions—
fedoraproject/fedoraall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (42)
https://access.redhat.com/security/cve/CVE-2023-51767 · [email protected]https://arxiv.org/abs/2309.02545 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2255850 · [email protected]https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77 · [email protected]https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878 · [email protected]https://security.netapp.com/advisory/ntap-20240125-0006/ · [email protected]https://ubuntu.com/security/CVE-2023-51767 · [email protected]https://www.openwall.com/lists/oss-security/2025/09/22/1 · [email protected]http://www.openwall.com/lists/oss-security/2025/09/22/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/22/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/23/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/23/3 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/23/4 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/23/5 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/24/4 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/24/7 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/25/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/25/6 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/26/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/26/4 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/2 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/3 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/4 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/5 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/6 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/27/7 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/28/7 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/29/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/29/4 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/29/5 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/09/29/6 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/10/01/1 · af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2025/10/01/2 · af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2023-51767 · af854a3a-2127-422b-91ae-364da2661108https://arxiv.org/abs/2309.02545 · af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2255850 · af854a3a-2127-422b-91ae-364da2661108https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77 · af854a3a-2127-422b-91ae-364da2661108https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240125-0006/ · af854a3a-2127-422b-91ae-364da2661108https://ubuntu.com/security/CVE-2023-51767 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 24 DEC 00:00Z
    OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated…
    cvelistv5