[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aNyAr-XUGTlZHWtg@dojo.mi.org>
Date: Tue, 30 Sep 2025 21:15:27 -0400
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: [EXT] Re: CVE-2023-51767: a
bogus CVE in OpenSSH
:> Second, I had expected ECC to "kill Rowhammer dead" only to find that it
:> can be possible to cause enough bit flips to get all the way from one
:> valid ECC word to another valid ECC word before ECC scrub reaches the
:> location. I suspect that the DDR5 built-in ECC is supposed to resolve
:> Rowhammer, but we will have to wait and see if it actually achieves that
:> goal.
You won't have to wait very long, it seems:
https://comsec.ethz.ch/research/dram/phoenix/
...
As someone who fielded inquiries about CVE-2023-51767 in the context
of some commercial OSes/platforms when it first came out, I'd suggest
this ought to be tagged as REJECTED. It's sad that this bogus CVE is
still causing confusion. This almost makes me long for the good ol'
days when CVEs stated out life as "candidates", and learned people
would weigh in on whether it should be promoted to a full CVE.
If I read this thread right, the author of the paper didn't request
this CVE, and it was assigned via MITRE (probably the result of some
external requester). I'd suggest bringing it up with MITRE, get to
the source of who actually made the CVE request, and properly dispose
of this. I'd suggest engaging MITRE directly, not just righteous
venting on oss-security, hoping it finds the right CVE folks.
Take FWIW...
-Mike
--
Michael J. O'Connor mjo@...o.mi.org
=--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Security freaks are pretty wierd." -Brian Harvey, RFC 686
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
