OpenSSL HollowByte Flaw Puts Servers at Risk with 11-Byte TLS Requests

OpenSSL's HollowByte flaw allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers with a malicious 11-byte TLS payload, which can cause servers to allocate up to 131 KB of memory for a message that never arrives.

Understanding the Attack Vector

The HollowByte flaw is a denial-of-service vulnerability in OpenSSL that allows remote, unauthenticated attackers to exhaust server memory with an 11-byte malicious payload. This payload can cause the server to allocate a large amount of memory, leading to a denial-of-service condition. The vulnerability is particularly concerning because it can be triggered with a very small amount of data, making it potentially difficult to detect and prevent.

Technical Details

The HollowByte flaw is related to the way OpenSSL handles TLS requests. When a server receives a TLS request, it allocates memory to process the request. However, in the case of the HollowByte flaw, the server allocates up to 131 KB of memory for a message that never arrives, leading to a memory exhaustion condition. This can cause the server to become unresponsive or even crash.

Who Is Affected

The HollowByte flaw affects OpenSSL servers that have not been patched with the latest update. This includes a wide range of servers and applications that use OpenSSL for TLS encryption. The vulnerability is particularly concerning for organizations that rely on OpenSSL for secure communication, such as financial institutions, healthcare organizations, and government agencies.

What the Sceptics Say

Some sceptics may argue that the HollowByte flaw is not a significant concern because the patch is already available and can be easily applied. However, this argument overlooks the fact that many organizations may not have applied the patch yet, and that the vulnerability can be exploited with a very small amount of data, making it potentially difficult to detect and prevent.

How to Defend

• Apply the latest OpenSSL patch to prevent exploitation of the HollowByte flaw.
• Monitor server memory usage to detect potential denial-of-service conditions.
• Implement TLS request filtering to prevent malicious payloads from reaching the server.

Key Takeaways

1. Security Teams: Apply the latest OpenSSL patch and monitor server memory usage to prevent exploitation of the HollowByte flaw.
2. CISOs: Ensure that all OpenSSL servers are patched and that TLS request filtering is implemented to prevent malicious payloads.
3. Developers: Use secure coding practices and ensure that all OpenSSL dependencies are up-to-date to prevent vulnerabilities like the HollowByte flaw.
4. End Users: Be aware of the potential for denial-of-service conditions and report any suspicious activity to the relevant authorities.

Sources

• The Hacker News: OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests
• BleepingComputer: HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload
• Security Affairs: OpenSSL Fixes HollowByte Memory Exhaustion Bug