[PATCH] memory consumption (DoS) in openssl CVE-2009-4355

["Michael K. Johnson" <johnsonm () rpath com>]

Previously, an initialization-related memory leak involving openssl
was given CVE-2008-1678 and worked around in mod_ssl; see for example
https://bugzilla.redhat.com/show_bug.cgi?id=447268
https://issues.apache.org/bugzilla/show_bug.cgi?id=44975
https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/224945
http://svn.apache.org/viewvc?view=rev&revision=654119

However, this did not resolve the general problem, and an rPath
customer recently reproduced essentially the same memory leak via
another pathway.  This new pathway was assigned CVE-2009-4355.
Initially, the suggestion was to fix the leak via modifications
to php or curl in the same way that mod_ssl was previously fixed,
but then Andy Grimm provided a patch to openssl that would not only
resolve the issue for curl/php but also for any other as-yet-unknown
new vectors.  Dr. Stephen Henson, an openssl core team member,
provided a new openssl patch which rPath has confirmed resolves
the issue, and which Dr. Henson is committing to upstream openssl.
Dr. Henson's patch is attached to this email.

The specific symptom of this new pathway is that any vulnerable
system will leak hundreds of KB of memory per SSLv3 connection after
apache has been gracefully restarted (SIGHUP).  Temporary mitigation
strategies include limiting the number of requests that an apache
worker can serve to limit the quantity of leaked memory, and doing
full restarts rather than graceful restarts of apache.

Some discussion regarding this issue is in two issue reports:
https://issues.rpath.com/browse/RPL-3157
https://bugzilla.redhat.com/show_bug.cgi?id=546707

(I cannot make the Red Hat bugzilla report public, but assume
that it will be made public today.)

Attachment: CVE-2009-4355.patch
Description: