Incorrect Buffer Freedom in OpenSSL May Lead to Use After Free Vulnerability

CVE-2024-4741

What is CVE-2024-4741?

A vulnerability in OpenSSL's SSL_free_buffers function can lead to use after free conditions. This occurs under specific circumstances where freed memory might still be accessed, leading to possible data corruption, application crashes, or arbitrary code execution. The issue is tied to situations where a network record's body has not been completely processed, allowing SSL_free_buffers to be called erroneously. Although this issue has the potential for exploitation, it is currently not known to be actively targeted by malicious actors. Importantly, specific FIPS modules are not impacted, highlighting the need for cautious deployment and patching.

News Articles

Rewterz

CVE-2024-4741

CVE-2024-4741 – OpenSSL Vulnerability - Rewterz

OpenSSL could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the SSL_free_buffers API function.

References