[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <44a9b0c6-653a-4c52-a81c-0620b7082233@gmail.com>
Date: Sat, 27 Sep 2025 04:03:42 -0400
From: Demi Marie Obenour <demiobenour@...il.com>
To: Peter Gutmann <pgut001@...auckland.ac.nz>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"Adiletta, Andrew" <ajadiletta@....edu>, Solar Designer
<solar@...nwall.com>, Andrew Cooper <andrew.cooper3@...rix.com>,
"jcb62281@...il.com" <jcb62281@...il.com>
Cc: "openssh@...nssh.com" <openssh@...nssh.com>, "Tol, Caner" <mtol@....edu>,
"Sunar, Berk" <sunar@....edu>, "Doroz, Yarkin" <ydoroz@....edu>,
"Todd C. Miller" <Todd.Miller@...rtesan.com>
Subject: Re: Re: [EXT] Re: CVE-2023-51767: a
bogus CVE in OpenSSH
On 9/27/25 02:28, Peter Gutmann wrote:
> Jacob Bachmeyer <jcb62281@...il.com> writes:
>
>> I am somewhat skeptical about this, simply because there have been many
>> "proper solutions" to Rowhammer that have thus far failed.
>
> It depends on what you mean by "failed". Rowhammer is an attack that no
> (real-life) attacker has ever used, and no real-life attacker will ever use,
> because there are about, oh, six million much easier ways to get what you
> want. So while a theoretical defence has failed against a theoretical attack,
> in practice nothing of value has been lost.
>
> (Not saying that it's not a cool attack, just that it's not one we have to
> worry about. What we do have to worry about is phishing, buffer overflows,
> SQL and more generally script injection, supply-chain attacks, it's a long list).
>
> Peter.
What about attackers trying to escape VMs? At some point
the hardware might actually become the weakest link. Is
there something about Rowhammer specifically that makes it
an unattractive attack, even for nation-state attackers
against well-protected targets?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Download attachment "OpenPGP_0xB288B55FFF9C22C1.asc" of type "application/pgp-keys" (7141 bytes)
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
