Advisory ID: ZPE-NG-2024-003
First Published: Oct 01, 2024
CVE ID: CVE-2023-51767 (details on NIST.gov)
CVSSv3 Base Score: 7.0 (High)
OpenSSH, when common types of DRAM are used, might allow rowhammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.
This vulnerability could theoretically lead to authentication bypass.
The attack has only been demonstrated in a modified environment which facilitated the attack, and is improbable to succeed in production environments.
The use of ASLR, Address-Space Layout Randomization, implemented at the Operating System level by the Linux kernel, makes the attack less likely to succeed.
Nodegrid Net Services Router, Gate SR, Hive SR, and Serial Console Plus employs DDR4 memory which are less susceptible to bit flips, making this vulnerability harder to exploit and hence less likely to succeed.