oss-sec mailing list archives
[PATCH] memory consumption (DoS) in openssl CVE-2009-4355
From: "Michael K. Johnson" <johnsonm () rpath com>
Date: Wed, 13 Jan 2010 10:15:48 -0500
Previously, an initialization-related memory leak involving openssl was given CVE-2008-1678 and worked around in mod_ssl; see for example https://bugzilla.redhat.com/show_bug.cgi?id=447268 https://issues.apache.org/bugzilla/show_bug.cgi?id=44975 https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/224945 http://svn.apache.org/viewvc?view=rev&revision=654119 However, this did not resolve the general problem, and an rPath customer recently reproduced essentially the same memory leak via another pathway. This new pathway was assigned CVE-2009-4355. Initially, the suggestion was to fix the leak via modifications to php or curl in the same way that mod_ssl was previously fixed, but then Andy Grimm provided a patch to openssl that would not only resolve the issue for curl/php but also for any other as-yet-unknown new vectors. Dr. Stephen Henson, an openssl core team member, provided a new openssl patch which rPath has confirmed resolves the issue, and which Dr. Henson is committing to upstream openssl. Dr. Henson's patch is attached to this email. The specific symptom of this new pathway is that any vulnerable system will leak hundreds of KB of memory per SSLv3 connection after apache has been gracefully restarted (SIGHUP). Temporary mitigation strategies include limiting the number of requests that an apache worker can serve to limit the quantity of leaked memory, and doing full restarts rather than graceful restarts of apache. Some discussion regarding this issue is in two issue reports: https://issues.rpath.com/browse/RPL-3157 https://bugzilla.redhat.com/show_bug.cgi?id=546707 (I cannot make the Red Hat bugzilla report public, but assume that it will be made public today.)
Attachment:
CVE-2009-4355.patch
Description:
Current thread:
- [PATCH] memory consumption (DoS) in openssl CVE-2009-4355 Michael K. Johnson (Jan 13)