Okta’s red team uncovered HollowByte, a denial-of-service flaw in OpenSSL that lets an attacker exhaust server memory with only an 11-byte payload before any security handshake completes. The issue affects many OpenSSL-based applications and was patched in OpenSSL 4.0.1 and backported to 3.6.3, 3.5.7, 3.4.6, and 3.0.21. #OpenSSL #HollowByte #Okta
Keypoints
- HollowByte is a denial-of-service vulnerability in OpenSSL.
- An 11-byte payload can trigger oversized buffer pre-allocation.
- The flaw can exhaust memory before any security handshake occurs.
- glibc memory handling can keep freed memory from being reused quickly.
- OpenSSL fixed the issue in version 4.0.1 and backported the patch to older releases.
Read More: https://www.securityweek.com/openssl-silently-fixes-hollowbyte-dos-vulnerability/