OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability
A denial-of-service vulnerability, dubbed ‘HollowByte,’ in OpenSSL allows attackers to exhaust server memory by crafting a small payload that triggers excessive buffer allocations. This can lead to complete system lockups, requiring a restart. Patches have been silently rolled out to address the issue, impacting a wide range of applications and servers relying on OpenSSL.
A denial-of-service vulnerability, referred to as ‘HollowByte,’ has been discovered in OpenSSL. Okta’s red team identified the issue, which stems from a flaw in how OpenSSL handles incoming message sizes during the handshake process. Specifically, older OpenSSL iterations pre-allocated receive buffer sizes based on the handshake message’s 4-byte header, regardless of the actual data received.
The vulnerability is triggered by sending a small payload (11 bytes) that forces the OpenSSL library to allocate a large buffer. Because the GNU C Library (glibc) retains small-to-medium memory allocations, even after OpenSSL frees the buffer, attackers can repeatedly send payloads to exhaust server memory.
Real-world testing demonstrated that a 1 GB RAM system became unresponsive after 547 MB of memory was fragmented and frozen. On a 16 GB RAM system, the attack successfully locked up 25% of the system’s total memory while staying safely under the connection ceiling, bypassing standard connection-limiting defenses.
Apache, NGINX, Node.js, Python, Ruby, PHP, MySQL, PostgreSQL, and other applications, servers, runtimes, and databases that use OpenSSL are affected unless they upgrade to a patched version of the open source library. Patches were silently included in OpenSSL version 4.0.1 and backported to versions 3.6.3, 3.5.7, 3.4.6, and 3.0.21.
Related: Chrome 150 Update Patches Severe Memory Safety Bugs
Related: Nightmare Eclipse Drops ‘LegacyHive’ Windows Zero-Day
Related: Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow