VulnerabilityPublished 24 Dec 2023Updated 18 Nov 2025

CVE-2023-51767: OpenSSH · CVE-2023-51767 is a

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.6% chance of exploitation in 30 days – higher than 51% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Affects: OpenSSH up to 10.0

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Dec 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Mitigation should focus on reducing the feasibility of row hammer attacks and limiting attacker capabilities. European organizations should: 1) Upgrade DRAM hardware to models with row hammer mitigation features or ECC memory to detect and correct bit flips. 2) Employ strict tenant isolation in virtualized and cloud environments to prevent attacker-victim co-location on the same physical host. 3) Monitor authentication logs for anomalies indicative of authentication bypass attempts. 4) Use additional layers of authentication such as multi-factor authentication (MFA) to reduce reliance on single authentication mechanisms vulnerable to bit flips. 5) Keep OpenSSH updated and monitor vendor advisories for any future patches or mitigations. 6) Consider deploying memory integrity checking tools or hardware-based security features that can detect or prevent row hammer style attacks. 7) Limit user privileges and access to reduce the risk of attackers gaining the necessary user-level access to perform the attack. These steps go beyond generic advice by addressing the hardware and environment-specific nature of the threat.

Description

CVE-2023-51767 is a vulnerability in OpenSSH up to version 10.0 that could allow an attacker with user privileges co-located on the same physical machine to perform a row hammer attack to bypass authentication. The issue arises because the integer variable 'authenticated' in the mm_answer_authpassword function is susceptible to single-bit flips caused by row hammer effects in DRAM. This vulnerability exploits a hardware-level weakness rather than a traditional software flaw, and the OpenSSH supplier disputes responsibility for mitigating such architectural hardware issues. No known exploits are currently reported in the wild. The attack requires the attacker to have user-level access and physical memory proximity, making it a niche but potentially serious threat in multi-tenant environments. European organizations using OpenSSH in shared hosting or cloud environments should be aware of this risk. Mitigations include hardware upgrades, memory isolation, and monitoring for abnormal authentication behavior. Countries with significant cloud infrastructure and high OpenSSH usage are more likely to be impacted.

Impact

For European organizations, the impact of CVE-2023-51767 could be significant in environments where OpenSSH is used on shared physical infrastructure, such as cloud service providers, data centers, and virtualized hosting platforms. Successful exploitation could lead to unauthorized access by bypassing authentication, potentially allowing attackers to escalate privileges or move laterally within networks. This threatens confidentiality, integrity, and availability of critical systems. Sectors such as finance, government, and critical infrastructure, which heavily rely on secure remote access, are particularly at risk. However, the requirement for attacker co-location and user privileges limits the attack surface, reducing the likelihood of widespread exploitation. Nonetheless, organizations with multi-tenant environments or those using older OpenSSH versions without mitigations may face increased risk. The lack of a patch and the supplier’s stance may delay remediation efforts, increasing exposure time.

Summary

CVE-2023-51767 identifies a vulnerability in OpenSSH versions through 10.0 related to susceptibility to row hammer attacks on DRAM memory. Row hammer is a hardware-based attack that induces bit flips in memory cells by repeatedly accessing adjacent rows, potentially altering critical data. In this case, the integer variable 'authenticated' within the mm_answer_authpassword function can have its bits flipped, potentially causing the system to incorrectly treat an unauthenticated user as authenticated, effectively bypassing authentication controls. This vulnerability requires a specific threat model: the attacker must have user-level privileges on the same physical host as the victim, enabling them to perform the row hammer attack on shared DRAM. The supplier of OpenSSH has disputed the classification of this as a vulnerability within the application, arguing that defending against hardware architectural weaknesses is outside the scope of the software. No patches or fixes have been issued, and no known exploits have been observed in the wild. The vulnerability highlights the intersection of hardware vulnerabilities and software security, particularly in multi-tenant environments such as cloud or virtualized servers where physical co-location is common. Exploitation could allow privilege escalation or unauthorized access, undermining the confidentiality and integrity of systems relying on OpenSSH for secure authentication.

References

Community reviews

Loading reviews…