PT-2024-4664 · Openssl+10 · Openssl+10
Matt Caswell
+2
·
Published
2024-05-10
·
Updated
2026-04-27
·
CVE-2024-4741
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
OpenSSL versions prior to 3.3 (FIPS modules in 3.3, 3.2, 3.1, and 3.0 are not affected)
Description:
The issue is related to the
SSL free buffers function in OpenSSL, which can cause memory to be accessed after it has been freed in certain situations. This can lead to corruption of valid data, crashes, or execution of arbitrary code. The function is used to free the internal OpenSSL buffer when processing an incoming record from the network. However, two scenarios have been identified where the buffer is freed even when still in use. A malicious attacker could attempt to engineer a situation where this occurs, although it is not aware of this issue being actively exploited.Recommendations:
As a temporary workaround, consider disabling the
SSL free buffers function until a patch is available.
Restrict access to the vulnerable SSL free buffers function to minimize the risk of exploitation.
Avoid using the SSL free buffers function in applications that directly call it, as these are the only applications affected by this issue.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Ibm Aix
Linuxmint
Openssl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu