Openssh · Openssh · CVE-2023-51767
**Name of the Vulnerable Software and Affected Versions**
OpenSSH versions 9.6 and earlier
**Description**
The issue is related to a potential row hammer attack that could allow authentication bypass. This is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges. The problem lies in the `mm answer authpassword` function, where the integer value of `authenticated` does not resist flips of a single bit, potentially leading to a security bypass. It is estimated that about 116,668,063 devices worldwide might be affected, mainly distributed in the United States, China, and other countries.
**Recommendations**
For OpenSSH versions 9.6 and earlier, consider disabling the `mm answer authpassword` function as a temporary workaround until a patch is available. Restrict access to the vulnerable function to minimize the risk of exploitation. Avoid using the `authenticated` variable in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.