HollowByte vulnerability allows denial-of-service attacks on OpenSSL

A denial-of-service (DoS) vulnerability, dubbed HollowByte, has been discovered in OpenSSL that allows unauthenticated attackers to crash servers with a minimal malicious payload. The OpenSSL team has addressed the issue by silently patching it and backporting the fix to older versions, as reported by Bleeping Computer.

The HollowByte vulnerability, detailed by Okta's Red Team, exploits a flaw in how OpenSSL handles TLS handshake messages. Attackers can send an 11-byte payload with a header falsely claiming a much larger message size. Vulnerable OpenSSL versions allocate memory based on this false claim before validating the actual data, causing the server's worker threads to block indefinitely. This can lead to significant memory fragmentation and a continuous increase in the server's Resident Set Size, requiring a process restart to reclaim memory.

OpenSSL is a foundational library for secure internet communication, embedded in popular software like NGINX, Apache, Node.js, Python, and various databases. While DoS attacks are typically less severe than data breaches, HollowByte can cause operational disruptions and reputational damage, even on high-spec servers where memory loss can reach 25% without triggering alerts. The fix, backported to multiple OpenSSL versions, ensures memory is allocated only after data arrival, ignoring header claims.

Source: Bleeping Computer