{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nopenssh:\n  * openssh-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-askpass-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-clients-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-keycat-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-keysign-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-server-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-sk-dummy-10.3p1-2.hum1 (aarch64, x86_64)\n  * openssh-10.3p1-2.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:9221",
        "url": "https://access.redhat.com/errata/RHSA-2026:9221"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-51767",
        "url": "https://access.redhat.com/security/cve/CVE-2023-51767"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9221.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-04-21T19:46:37+00:00",
      "generator": {
        "date": "2026-04-21T19:46:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:9221",
      "initial_release_date": "2026-04-21T06:25:52+00:00",
      "revision_history": [
        {
          "date": "2026-04-21T06:25:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-21T17:49:19+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-21T19:46:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-main@aarch64",
                "product": {
                  "name": "openssh-main@aarch64",
                  "product_id": "openssh-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.3p1-2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-main@src",
                "product": {
                  "name": "openssh-main@src",
                  "product_id": "openssh-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.3p1-2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssh-main@x86_64",
                "product": {
                  "name": "openssh-main@x86_64",
                  "product_id": "openssh-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openssh@10.3p1-2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-main@aarch64"
        },
        "product_reference": "openssh-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-main@src"
        },
        "product_reference": "openssh-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssh-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:openssh-main@x86_64"
        },
        "product_reference": "openssh-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-51767",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2023-12-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2255850"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An authentication bypass vulnerability was found in a modified version of OpenSSH. When common types of DRAM memory are used, it might allow row hammer attacks because the integer value of authenticated authpassword does not resist flips of a single bit. Exploiting a Rowhammer-style attack to flip bits in memory, forces successful authentication by setting the return code to 0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: authentication bypass via row hammer attack",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "THIS IS A HARDWARE PROBLEM THAT CANNOT BE FIXED as a software-level fix is ineffective.\n\nRed Hat has determined this vulnerability to be a Moderate impact because it targets the local system and lacks a widespread impact beyond compromising the integrity of individual processes by exploiting CPU internals and stack variables.\n\nMORE ABOUT THIS ISSUE:\n\n\"Mayhem\" is a potent attack technique that focuses on the core components of computing systems, specifically the CPU internals and stack variables. This method signifies a noteworthy advancement in cyber threats, demonstrating the ability to tamper with a computer\u0027s memory and compromise both stack and register variables. Capitalizing on the well-known Rowhammer effect, where swift access to a DRAM row induces bit flips in neighboring rows, this attack exploits these bit flips to disrupt stack variables and manipulate register values within a given process. The manipulation is accomplished by targeting register values stored in the process\u0027 stack, which, once flushed out to memory, become vulnerable to Rowhammer attacks. When reloaded, these corrupted values cause chaos, compromising the integrity of the entire process. \n\nIt\u0027s important to note that this attack is confined to the local system, leading us to categorize it as a moderate threat.\n\nAccess to the platform is granted only after successful authentication through multifactor authentication (MFA). Domain accounts are configured to lock out based on predefined access policies, reducing the effectiveness of brute-force attacks on authentication mechanisms. The platform employs IAM roles for identification and authentication within its cloud infrastructure that govern user access to resources and manage provisioning, deployment, and configuration within the platform environment. \n\nThis reduces the risk of unauthorized access through third-party or external user accounts. Finally, memory protection mechanisms are used to enhance resilience against unauthorized commands or improper authentication.\n\nThe research presented in the provided link introduces the attack described below: https://arxiv.org/abs/2309.02545",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:openssh-main@aarch64",
          "Red Hat Hardened Images:openssh-main@src",
          "Red Hat Hardened Images:openssh-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-51767"
        },
        {
          "category": "external",
          "summary": "RHBZ#2255850",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255850"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-51767",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-51767"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-51767",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51767"
        },
        {
          "category": "external",
          "summary": "https://arxiv.org/abs/2309.02545",
          "url": "https://arxiv.org/abs/2309.02545"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77",
          "url": "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/auth-passwd.c#L77"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878",
          "url": "https://github.com/openssh/openssh-portable/blob/8241b9c0529228b4b86d88b1a6076fb9f97e4a99/monitor.c#L878"
        }
      ],
      "release_date": "2023-12-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-21T06:25:52+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:openssh-main@aarch64",
            "Red Hat Hardened Images:openssh-main@src",
            "Red Hat Hardened Images:openssh-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:9221"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\nThere is no upstream solution. Changing the success code logic would break system behavior. Since Rowhammer exploits physical DRAM faults, software-level fixes are ineffective, and no mitigation will be pursued.",
          "product_ids": [
            "Red Hat Hardened Images:openssh-main@aarch64",
            "Red Hat Hardened Images:openssh-main@src",
            "Red Hat Hardened Images:openssh-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:openssh-main@aarch64",
            "Red Hat Hardened Images:openssh-main@src",
            "Red Hat Hardened Images:openssh-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssh: authentication bypass via row hammer attack"
    }
  ]
}