It was discovered that OpenSSL incorrectly allocated memory buffers in the SSL/TLS state machine when receiving handshake data. A remote attacker could possibly use this issue to cause OpenSSL to consume excessive memory, leading to a denial of service. This issue is known as the "HollowByte" denial of service.

Read more

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes.

Okta disclosed HollowByte, an 11-byte OpenSSL flaw that lets remote attackers exhaust server memory and trigger denial-of-service attacks.

Okta Red Teamが公表したOpenSSLの新しいDoS脆弱性「HollowByte」を解説。わずか11バイトのペイロードで未認証のままメモリを枯渇させる仕組み、glibcのメモリ管理を悪用した永続的な断片化のメカニズム、CVE番号が付与されなかった経緯と情報システム部門が取るべき対策をまとめました

OpenSSLはWebサイトのHTTPS通信を支える代表的な暗号ライブラリです。NGINXやApacheなどのWebサーバーをはじめ、さまざまなアプリケーションやミドルウェアで利用されています。OpenSSLに対して、わずかな通信データでサーバーのメモリを大量に消費させる攻撃手法「HollowByte」が報告されました。 HollowByteは暗号を解読したり、秘密鍵を盗み出したりする攻撃ではあり...

Die OpenSSL-Maintainer haben stillschweigend eine Denial-of-Service-Lücke geschlossen. Okta nennt sie „HollowByte“.

Die OpenSSL-Maintainer haben stillschweigend eine Denial-of-Service-Lücke geschlossen. Okta nennt sie „HollowByte“.

The OpenSSL maintainers silently patched a Denial-of-Service (DoS) vulnerability, which security firm Okta has named HollowByte. The flaw was addressed without prior public disclosure, though no specific technical details, CVE identifier, or affected OpenSSL versions were provided in the report. The vulnerability's impact is limited to DoS conditions, with no mention of remote code execution or privilege escalation risks. The naming of the flaw by Okta suggests external discovery, but the article does not clarify the timeline of disclosure or patch release. No additional technical specifics, such as exploit vectors or mitigation steps, were disclosed.

La faille HollowByte sature la mémoire d'un serveur OpenSSL avec un paquet de 11 octets. Corrigée en silence depuis la version 4.0.1, et sans aucun CVE.

A vulnerability dubbed HollowByte allows unauthenticated attackers to trigger a denial-of-service (DoS) condition on OpenSSL servers with a malicious payload of just 11 bytes. The OpenSSL team has sil...

Attackers could send waves of malicious payloads to trigger buffer pre-allocations that are not freed, exhausting server memory.