A denial-of-service vulnerability has been identified in OpenSSL, allowing attackers to disrupt service by sending small TLS requests. The flaw, internally dubbed "HollowByte," can be triggered with an 11-byte TLS request, leading to significant memory allocation issues on vulnerable servers.
Specifically, the vulnerability causes affected servers to allocate up to 131 KB of memory per malicious request. This memory remains allocated and unavailable for legitimate use until the server process is manually restarted. The cumulative effect of multiple such requests can quickly exhaust available memory resources, leading to a denial of service.
The issue is particularly pronounced on systems utilizing glibc, a common C standard library. While OpenSSL is the primary affected component, the interaction with glibc appears to exacerbate the memory allocation problem, making these systems more susceptible to rapid resource exhaustion.
The technical mechanism behind HollowByte involves an inefficient handling of certain malformed or unexpected TLS handshake messages within OpenSSL. When the specially crafted 11-byte request is received, it triggers a memory allocation routine that reserves a disproportionately large block of memory compared to the size of the input. This memory is not properly deallocated or reused, leading to a steady drain on system resources.
Mitigation for this class of denial-of-service vulnerability typically involves applying vendor-provided patches. In this instance, a fix for the HollowByte flaw was reportedly released in June. System administrators are advised to ensure their OpenSSL installations are updated to the latest stable versions to incorporate this and other security fixes. Regular patching cycles are critical for maintaining the security and stability of internet-facing services.
This vulnerability underscores the ongoing challenges in securing fundamental cryptographic libraries that underpin much of the internet's secure communication. Even small, seemingly innocuous requests can be weaponized to exploit subtle flaws in complex software stacks. The delayed disclosure of such fixes, while sometimes necessary for coordinated patching, also highlights the importance of proactive security practices and continuous monitoring for anomalies in server behavior.
