We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·17d ago·5 min read
OpenSSL HollowByte: A DoS Hiding in 11 Bytes
TL;DR
A new Denial of Service (DoS) vulnerability named HollowByte was discovered in OpenSSL, allowing attackers to exploit a 4-byte header. By sending a malicious 11-byte payload, an attacker can cause excessive memory allocation before the TLS handshake begins.
✦ Why It Matters
Update OpenSSL to the latest version to protect against the HollowByte DoS vulnerability and prevent potential service disruptions.
Key Takeaways
- Upgrade OpenSSL to the latest version to mitigate vulnerabilities.
- Monitor server memory usage to detect potential DoS attacks.
- Implement connection-limiting defenses to reduce exposure.
- Test your applications for vulnerabilities related to OpenSSL.
How It Works
The vulnerability arises during the TLS handshake when an attacker sends a malicious header that claims a large message size. Older OpenSSL versions allocate memory based on this unvalidated header, leading to excessive memory usage.
The server then blocks while waiting for the actual data, which never arrives, causing resource exhaustion.