{"id":"CVE-2023-51767","aliases":["ALPINE-CVE-2023-51767","EUVD-2023-56456","GHSA-27q9-h529-q4g3","RHSA-2026:9221","ROOT-OS-DEBIAN-11-CVE-2023-51767","ROOT-OS-DEBIAN-12-CVE-2023-51767","UBUNTU-CVE-2023-51767"],"status":"disputed","title":"OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for...","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00661,"percentile":0.52068,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-12-24T00:00:00Z","modified":"2026-10-28T02:30:51Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssh","fixed_in":["9.7_p1-r0"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"openssh","fixed_in":["1:8.4p1-5+deb11u7.root.io.9","1:8.4p1-5+deb11u7.aikido.10","1:8.4p1-5+deb11u7.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-openssh","fixed_in":["1:8.4p1-5+deb11u7.root.io.9","1:8.4p1-5+deb11u7.aikido.10","1:8.4p1-5+deb11u7.aikido.11"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"openssh","fixed_in":["1:9.2p1-2+deb12u10.root.io.11","1:9.2p1-2+deb12u10.aikido.14","1:9.2p1-2+deb12u10.root.io.13","1:9.2p1-2+deb12u10.root.io.12","1:9.2p1-2+deb12u10.aikido.15","1:9.2p1-2+deb12u10.aikido.16"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-openssh","fixed_in":["1:9.2p1-2+deb12u10.root.io.11","1:9.2p1-2+deb12u10.aikido.14","1:9.2p1-2+deb12u10.root.io.13","1:9.2p1-2+deb12u10.root.io.12","1:9.2p1-2+deb12u10.aikido.15","1:9.2p1-2+deb12u10.aikido.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.7_p1-r0"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.4p1-5+deb11u7.root.io.9"},{"fixed":"1:8.4p1-5+deb11u7.aikido.10"},{"fixed":"1:8.4p1-5+deb11u7.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.4p1-5+deb11u7.root.io.9"},{"fixed":"1:8.4p1-5+deb11u7.aikido.10"},{"fixed":"1:8.4p1-5+deb11u7.aikido.11"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u10.root.io.11"},{"fixed":"1:9.2p1-2+deb12u10.aikido.14"},{"fixed":"1:9.2p1-2+deb12u10.root.io.13"},{"fixed":"1:9.2p1-2+deb12u10.root.io.12"},{"fixed":"1:9.2p1-2+deb12u10.aikido.15"},{"fixed":"1:9.2p1-2+deb12u10.aikido.16"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-openssh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.2p1-2+deb12u10.root.io.11"},{"fixed":"1:9.2p1-2+deb12u10.aikido.14"},{"fixed":"1:9.2p1-2+deb12u10.root.io.13"},{"fixed":"1:9.2p1-2+deb12u10.root.io.12"},{"fixed":"1:9.2p1-2+deb12u10.aikido.15"},{"fixed":"1:9.2p1-2+deb12u10.aikido.16"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openbsd","product":"openssh"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://arxiv.org/abs/2309.02545","tags":["x_transferred","Technical Description","web","article","report"]},{"url":"https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878","tags":["x_transferred","Product","web","article"]},{"url":"https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77","tags":["x_transferred","Product","web","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255850","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-51767","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://ubuntu.com/security/CVE-2023-51767","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240125-0006/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2025/09/22/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/01/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/22/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/24/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/22/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/23/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/10/01/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/26/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/26/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/3","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/5","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/6","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/7","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/29/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/29/5","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/23/1","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/29/6","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/23/3","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/23/5","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/24/7","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/25/2","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/25/6","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/27/4","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/28/7","tags":["web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/29/1","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51767","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240125-0006"},{"url":"https://github.com/advisories/GHSA-27q9-h529-q4g3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-51767","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51767.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9221","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9221.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-51767","tags":["advisory","report"]}],"sources":{"cve":[{"id":"CVE-2023-51767","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","status":"disputed","published":"2023-12-24T00:00:00Z","modified":"2026-10-15T00:16:50.185Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-56456","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","status":"published","published":"2023-12-24T00:00:00Z","modified":"2026-10-15T00:16:50Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-27q9-h529-q4g3","title":"OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for...","description":"OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.","status":"published","published":"2023-12-24T09:30:19Z","modified":"2026-10-15T03:34:12Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2023-51767","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","status":"disputed","published":"2023-12-24T07:15:07.41Z","modified":"2026-10-15T01:17:12.797Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"ALPINE-CVE-2023-51767","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","status":"published","published":"2023-12-24T07:15:07.41Z","modified":"2026-10-26T17:17:58.660951868Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"CVE-2023-51767","description":"OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states \"we do not consider it to be the application's responsibility to defend against platform architectural weaknesses.\"","status":"published","published":"2023-12-24T00:00:00Z","modified":"2026-10-28T02:30:51.308819943Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"RHSA-2026:9221","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"withdrawn","published":"2026-04-22T10:11:14Z","modified":"2026-09-06T14:00:03.916361913Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2023-51767","title":"CVE-2023-51767 in openssh - Patched by Root","description":"Root has patched CVE-2023-51767 in the openssh package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:25:15Z","modified":"2026-08-23T10:18:25.996397574Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.80888Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-51767","title":"CVE-2023-51767 in openssh - Patched by Root","description":"Root has patched CVE-2023-51767 in the openssh package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-10-19T08:24:56Z","modified":"2026-10-19T09:15:02.513276348Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2023-51767","description":"OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.","status":"withdrawn","published":"2023-12-24T07:15:00Z","modified":"2025-09-08T16:56:37Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"}]}}