What's Happening?
A vulnerability in OpenSSL, known as 'HollowByte', has been identified, allowing attackers to exhaust a server's memory before any security handshake. Discovered by Okta's red team, the denial-of-service (DoS) bug can be triggered by a malicious payload
of only 11 bytes, which declares a larger incoming message body to initiate a buffer pre-allocation that is not immediately freed. This vulnerability existed because older OpenSSL versions pre-allocated receive buffer sizes based on the incoming message body length declared in the handshake message's 4-byte header. The issue has been silently fixed in OpenSSL version 4.0.1 and backported to earlier versions.
Why It's Important?
The 'HollowByte' vulnerability highlights the ongoing challenges in maintaining secure open-source software. OpenSSL is widely used in various applications, servers, and databases, making this vulnerability particularly concerning. If exploited, it could lead to significant disruptions in services and potential data breaches. The silent patching of this vulnerability underscores the importance of regular updates and monitoring of open-source libraries to prevent exploitation. Organizations relying on OpenSSL must ensure they are using the latest patched versions to protect against potential attacks.
What's Next?
Organizations using OpenSSL are advised to upgrade to the latest patched versions to mitigate the risk posed by the 'HollowByte' vulnerability. This may involve reviewing and updating their software dependencies and ensuring that all systems are running secure versions of OpenSSL. Additionally, there may be increased scrutiny on the processes for disclosing and patching vulnerabilities in open-source software, potentially leading to more transparent and proactive security measures in the future.
