CVE-2023-51767

Vulnerability

According to the CVE description and references [1][2][4], OpenSSH through version 10.0, when used with common DRAM types, might be susceptible to row hammer attacks. The specific concern is that the integer value of authenticated in the mm_answer_authpassword function could be flipped by a single bit, leading to authentication bypass. The vulnerability requires attacker-victim co-location with the attacker having user privileges. The supplier disputes this, stating it is not the application's responsibility to defend against platform architectural weaknesses [3].

Exploitation

Exploitation would require the attacker to be co-located on the same system as the victim, with user-level privileges, and to execute a row hammer attack to induce a single bit flip in the authenticated variable during the authentication process [2][4]. The attacker would need to perform memory access patterns that cause DRAM row hammering, which is a platform-level attack.

Impact

If successfully exploited, the attacker could bypass authentication in OpenSSH, potentially gaining unauthorized access to the system. However, the OpenSSH developers and some third parties consider this infeasible in practice, as it depends on overcoming platform-level mitigations like ECC memory and modern DRAM refresh rates [3][4].

Mitigation

No official patch has been released by the OpenSSH project, as they dispute the vulnerability's validity [3]. Workarounds include using ECC memory, enabling hardware mitigations for row hammer attacks, and relying on platform security features. Ubuntu notes that the attack was demonstrated on a modified version of sshd and is not considered practically exploitable [4].