Bug 1218386 (CVE-2023-51767) - VUL-0: CVE-2023-51767: openssh: authentication bypass via single-bitflip DRAM attacks
Summary: VUL-0: CVE-2023-51767: openssh: authentication bypass via single-bitflip DRAM...
Status: RESOLVED WONTFIX
Alias: CVE-2023-51767
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/389286/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-51767:4.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-12-24 09:27 UTC by SMASH SMASH
Modified: 2024-05-17 08:02 UTC (History)
10 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-12-24 09:27:36 UTC 
OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51767
Comment 3 Stoyan Manolov 2024-02-20 09:59:25 UTC 
This morning we had a thorough review of the vulnerability with the team and we are concerned that this vulnerability is exploitable only in specific lab type environment. We will keep an eye on this vulnerability and any future types of Row Hammer attack vulnerabilities - they are harder to exploit and would require special configuration cases to be exploited anyways. For now the public pages will display WONTFIX but I will keep the bug open unless there is more information shared or publicly available.
Comment 6 Tamil Selvam 2024-02-23 12:25:59 UTC 
Hi Team,

Do you have an ETA for this issue ?

Regards,
Tamil Selvam .P
Comment 7 Marcus Meissner 2024-02-23 12:51:27 UTC 
We are currently not planning to fix this issue, as it can only appear in strictly controlled laboratory conditions.
Comment 8 Andrea Mattiazzo 2024-05-17 08:02:32 UTC 
Closing as wont fix.