Re: Re: [EXT] Re: [oss-security] CVE-2023-51767: a bogus CVE in OpenSSH

[Emilio Pozuelo Monfort <pochu27 () gmail com>]

On 01/10/2025 03:15, Mike O'Connor wrote:
> :> Second, I had expected ECC to "kill Rowhammer dead" only to find that it
> :> can be possible to cause enough bit flips to get all the way from one
> :> valid ECC word to another valid ECC word before ECC scrub reaches the
> :> location.  I suspect that the DDR5 built-in ECC is supposed to resolve
> :> Rowhammer, but we will have to wait and see if it actually achieves that
> :> goal.
>
> You won't have to wait very long, it seems:
> https://comsec.ethz.ch/research/dram/phoenix/
>
> ...
>
> As someone who fielded inquiries about CVE-2023-51767 in the context
> of some commercial OSes/platforms when it first came out, I'd suggest
> this ought to be tagged as REJECTED.  It's sad that this bogus CVE is
> still causing confusion.  This almost makes me long for the good ol'
> days when CVEs stated out life as "candidates", and learned people
> would weigh in on whether it should be promoted to a full CVE.
>
> If I read this thread right, the author of the paper didn't request
> this CVE, and it was assigned via MITRE (probably the result of some
> external requester).  I'd suggest bringing it up with MITRE, get to
> the source of who actually made the CVE request, and properly dispose
> of this.  I'd suggest engaging MITRE directly, not just righteous
> venting on oss-security, hoping it finds the right CVE folks.

The CVE got assigned by MITRE, so one can dispute it with MITRE directly. 
Apparently it's already been done, and the CVE appears as disputed [1]. I'm not 
sure if it will go from there to rejected.

Cheers,
Emilio

[1] https://www.cve.org/CVERecord?id=CVE-2023-51767