Threats Tagged 'cve-2023-51767'

CVE-2023-51767 is a vulnerability in OpenSSH up to version 10.0 that could allow an attacker with user privileges co-located on the same physical machine to perform a row hammer attack to bypass authentication. The issue arises because the integer variable 'authenticated' in the mm_answer_authpassword function is susceptible to single-bit flips caused by row hammer effects in DRAM. This vulnerability exploits a hardware-level weakness rather than a traditional software flaw, and the OpenSSH supplier disputes responsibility for mitigating such architectural hardware issues. No known exploits are currently reported in the wild. The attack requires the attacker to have user-level access and physical memory proximity, making it a niche but potentially serious threat in multi-tenant environments. European organizations using OpenSSH in shared hosting or cloud environments should be aware of this risk. Mitigations include hardware upgrades, memory isolation, and monitoring for abnormal authentication behavior. Countries with significant cloud infrastructure and high OpenSSH usage are more likely to be impacted.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2023-51767