OpenSSL: Use After Free
CVE-2024-4741 is a critical-severity use after free vulnerability in OpenSSL, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3.3.1, 3.2.2, 3.1.6 as the first without the flaw, so updating OpenSSL to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 3.28% chance of exploitation within 30 days, higher than 89% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update OpenSSL to 3.3.1 or 3.2.2 or 3.1.6 or 3.0.14, whichever matches your release line, or a later version.
- Read the advisory on openssl.org for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.3.0 up to, but not including, 3.3.1; 3.2.0 up to, but not including, 3.2.2; 3.1.0 up to, but not including, 3.1.6; 3.0.0 up to, but not including, 3.0.14; 1.1.1 up to, but not including, 1.1.1y | 3.3.1, 3.2.2, 3.1.6, 3.0.14, 1.1.1y |
| Debian | Debian Linux | 11.0 | Not stated |
| NetApp | Active Iq Unified Manager | Not specified in the record | Not stated |
| NetApp | Management Services For Element Software And Netapp Hci | Not specified in the record | Not stated |
| NetApp | Oncommand Workflow Automation | Not specified in the record | Not stated |
| NetApp | Ontap Select Deploy Administration Utility | Not specified in the record | Not stated |
| NetApp | Snapmanager | Not specified in the record | Not stated |
| NetApp | Brocade Fabric Operating System | Not specified in the record | Not stated |
| NetApp | 8300 Firmware | Not specified in the record | Not stated |
| NetApp | 8700 Firmware | Not specified in the record | Not stated |
| NetApp | A400 Firmware | Not specified in the record | Not stated |
| NetApp | C400 Firmware | Not specified in the record | Not stated |
| NetApp | A250 Firmware | Not specified in the record | Not stated |
| NetApp | 500f Firmware | Not specified in the record | Not stated |
| NetApp | C250 Firmware | Not specified in the record | Not stated |
| NetApp | A800 Firmware | Not specified in the record | Not stated |
| NetApp | C800 Firmware | Not specified in the record | Not stated |
| NetApp | A900 Firmware | Not specified in the record | Not stated |
| NetApp | 9500 Firmware | Not specified in the record | Not stated |
| NetApp | C190 Firmware | Not specified in the record | Not stated |
| NetApp | A150 Firmware | Not specified in the record | Not stated |
| NetApp | A220 Firmware | Not specified in the record | Not stated |
| NetApp | Fas2720 Firmware | Not specified in the record | Not stated |
| NetApp | Fas2750 Firmware | Not specified in the record | Not stated |
| NetApp | Fas2820 Firmware | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE; 10 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CISA (ADP).
Official description
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications. The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use. The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use. The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use. While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Patches and release notes
- github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177
- github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d
- github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac
- github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8
- github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4Permissions Required
Third-party and government advisories
- lists.debian.org/debian-lts-announce/2024/10/msg00033.htmlMailing List, Third Party Advisory
- lists.debian.org/debian-lts-announce/2024/11/msg00000.htmlMailing List, Third Party Advisory
- security.netapp.com/advisory/ntap-20240621-0004/Third Party Advisory
Other vulnerabilities in OpenSSL
- 7.5 High severity
- 7.5 High severity
- 8.2 High severity
- 7.5 High severity
- 7.5 High severity
- 9.1 Critical severity
Recent Use After Free vulnerabilities
- 7.8 High severity
- 8.8 High severity
- 8.8 High severity
- 7.8 High severity
- 8.8 High severity
- 7.8 High severity
Spotted an error? Tell us.