[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<ME0P300MB0713955695AB3F8BDB2F5C41EE19A@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM>
Date: Sat, 27 Sep 2025 06:28:54 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: Demi Marie Obenour <demiobenour@...il.com>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"Adiletta, Andrew" <ajadiletta@....edu>, Solar Designer <solar@...nwall.com>,
Andrew Cooper <andrew.cooper3@...rix.com>, "jcb62281@...il.com"
<jcb62281@...il.com>
CC: "openssh@...nssh.com" <openssh@...nssh.com>, "Tol, Caner" <mtol@....edu>,
"Sunar, Berk" <sunar@....edu>, "Doroz, Yarkin" <ydoroz@....edu>, "Todd C.
Miller" <Todd.Miller@...rtesan.com>
Subject: Re: Re: [EXT] Re: CVE-2023-51767: a
bogus CVE in OpenSSH
Jacob Bachmeyer <jcb62281@...il.com> writes:
>I am somewhat skeptical about this, simply because there have been many
>"proper solutions" to Rowhammer that have thus far failed.
It depends on what you mean by "failed". Rowhammer is an attack that no
(real-life) attacker has ever used, and no real-life attacker will ever use,
because there are about, oh, six million much easier ways to get what you
want. So while a theoretical defence has failed against a theoretical attack,
in practice nothing of value has been lost.
(Not saying that it's not a cool attack, just that it's not one we have to
worry about. What we do have to worry about is phishing, buffer overflows,
SQL and more generally script injection, supply-chain attacks, it's a long list).
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
