CVE-2023-51767: a bogus CVE in OpenSSH
Last updated 24 September 2025
Other sources
OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."
— MITRE
OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable password-based authentication in sshd_config (set PasswordAuthentication no) to avoid relying on the mm_answer_authpassword code path referenced in the advisory.
OpenSSH PasswordAuthentication = no - Compensating control
Mitigate the row-hammer co-location threat model by preventing untrusted/guest users from being co-located with targets (use isolation between tenants/VMs/containers) and by deploying hardware/platform mitigations where possible (use DRAM with protections such as ECC or vendor-provided row-hammer mitigations).
- Operational
Inventory deployed systems (including F5 Traffix Systems Signaling Delivery Controller instances) to determine whether they include OpenSSH installations 'through 10.0' or 'through 9.6' and identify servers allowing password authentication.
- Operational
There are no already-known fixed versions (ALREADY-KNOWN FIXED VERSIONS: (none)). Monitor upstream OpenSSH and vendor/supplier advisories for any future patches or official guidance and plan to apply vendor-supplied fixes when they become available.
- Operational
If password authentication cannot be disabled immediately, restrict SSH access via network controls (restrict source IPs, require jump hosts) and require stronger authentication (public-key only) where possible until a vendor patch or alternative mitigation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2023-51767?
CVE-2023-51767 is considered to have a moderate severity due to the potential for authentication bypass via row hammer attacks.
How do I fix CVE-2023-51767?
To mitigate CVE-2023-51767, upgrade OpenSSH to a version later than 9.6 that addresses this vulnerability.
Which software is affected by CVE-2023-51767?
CVE-2023-51767 affects OpenSSH versions up to and including 9.6, as well as specific versions of F5 Traffix SDC.
Can CVE-2023-51767 allow an attacker to bypass authentication?
Yes, CVE-2023-51767 may allow an attacker to bypass authentication under certain conditions due to a flaw in the authentication process.
What are row hammer attacks in relation to CVE-2023-51767?
Row hammer attacks exploit bit flips in DRAM to manipulate data, potentially allowing unauthorized access in the context of CVE-2023-51767.