---
id: CVE-2023-51767
title: >-
  OpenSSH through 10.0, when common types of DRAM are used, might allow row
  hammer attacks (for authentication bypass) because the integer value of
  authenticated in mm_answer_authpassword does not resist flips of a single bit
summary: >-
  OpenSSH through 10.0, when common types of DRAM are used, might allow row
  hammer attacks (for authentication bypass) because the integer value of
  authenticated in mm_answer_authpassword does not resist flips of a single bit.
  NOTE: this i…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: openbsd
product: openssh
affected:
  - openssh
  - fedora = 39
  - enterprise_linux = 8.0
  - enterprise_linux = 9.0
published: '2023-12-24'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:17:12.797'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-51767'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2023-51767'
    label: cve@mitre.org
  - url: 'https://arxiv.org/abs/2309.02545'
    label: cve@mitre.org
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2255850'
    label: cve@mitre.org
  - url: >-
      https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77
    label: cve@mitre.org
  - url: >-
      https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20240125-0006/'
    label: cve@mitre.org
  - url: 'https://ubuntu.com/security/CVE-2023-51767'
    label: cve@mitre.org
  - url: 'https://www.openwall.com/lists/oss-security/2025/09/22/1'
    label: cve@mitre.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/22/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/22/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/23/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/23/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/23/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/23/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/24/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/24/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/25/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/25/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/26/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/26/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/3'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/27/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/28/7'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/29/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/29/4'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/29/5'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/09/29/6'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/10/01/1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2025/10/01/2'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://access.redhat.com/security/cve/CVE-2023-51767'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://arxiv.org/abs/2309.02545'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2255850'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20240125-0006/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://ubuntu.com/security/CVE-2023-51767'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-794697.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00661
epssPercentile: 0.50469
ingestedAt: '2026-10-15T03:30:12.633Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-02T15:08:29.899238Z'
---

## Overview

OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. NOTE: this is disputed by the Supplier, who states "we do not consider it to be the application's responsibility to defend against platform architectural weaknesses."

## Affected

- `openssh`
- `fedora = 39`
- `enterprise_linux = 8.0`
- `enterprise_linux = 9.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.