StatewardStateward
← Toutes les vulnérabilités
HIGHInfraexploited in the wildcurated

CVE-2014-0160

OpenSSL · OpenSSL (TLS/DTLS heartbeat extension)

Résumé

Heartbleed, disclosed on 7 April 2014, was a flaw in OpenSSL, the encryption library that secures a huge share of the internet's HTTPS traffic. A single missing bounds check meant an attacker could ask a server a tiny question and get back up to 64 kilobytes of whatever happened to be sitting next to it in memory: usernames, passwords, session cookies, and, worst of all, the server's own private encryption keys, all without leaving a trace in any log. Because OpenSSL was everywhere, at disclosure a large fraction of all secure websites were exposed, and the world spent days re-issuing certificates and resetting passwords. It is the case that gave vulnerabilities a logo, and a permanent reminder that the open-source code underpinning the internet is often maintained by almost no one.

How it worked

TLS has a "heartbeat": a keep-alive feature where one side sends a small payload and asks the other to echo it back, saying in effect "here are N bytes, please return them." The bug was that OpenSSL trusted the sender's claim about N without checking it against the data actually sent. So an attacker could send a single byte but claim N was 64 kilobytes. OpenSSL would dutifully copy 64 kilobytes starting at the payload and send it all back, reading far past the end of the small buffer it had been given.

That overread is the whole attack. The ~64 kilobytes of adjacent process memory could contain anything the server had recently handled: other users' requests, their passwords and session cookies, and the server's private TLS key. It is a textbook buffer over-read, and because the request looked like a perfectly normal heartbeat, it left no trace in the logs. The 64-kilobyte limit was per request only, so repeating it thousands of times let an attacker sweep a server's memory for secrets at leisure.

The damage

At disclosure, an estimated 17% of the internet's "secure" web servers, half a million and more, were vulnerable, and anyone could quietly extract their private keys and credentials. The fix was not just patching OpenSSL: because the private keys themselves might have leaked, every affected site had to re-issue its TLS certificates and revoke the old ones, and force password resets, a global scramble. Real-world exploitation followed: the theft of about 4.5 million patient records from Community Health Systems in 2014 was attributed to Heartbleed on a vulnerable device, and Canada's tax agency lost 900 social-insurance numbers, an arrest following days later. Early skeptics doubted a server's private key could really be pulled from memory, until Cloudflare ran a public challenge on a live vulnerable server and several researchers extracted the full key using only Heartbleed, which is why mass certificate re-issuance became mandatory rather than optional. Heartbleed also changed the culture: with a name and a logo, it was the first vulnerability to be branded for the public.

Why Heartbleed still matters

Heartbleed teaches two enduring lessons. The first is about memory-unsafe languages: this was a classic buffer over-read in C, exactly the kind of bug that memory-safe languages like Rust and Go eliminate by design, which is a major reason critical infrastructure is slowly migrating to them. The second is the open-source funding crisis: OpenSSL secured most of the internet yet was maintained by a tiny, underfunded team, and the bug came from one volunteer's well-meaning patch (Robin Seggelmann's implementation of the heartbeat feature, committed on the last day of 2011 and shipped in OpenSSL 1.0.1, where it sat live for over two years) that a single reviewer missed. It directly led to the creation of industry funds for critical open source, the same root cause that nearly gave us the xz backdoor a decade later. Google's Neel Mehta, who co-discovered it, donated his $15,000 bug bounty to the Freedom of the Press Foundation. It is also a sibling of Shellshock, the other branded, internet-wide bug of 2014.

Comment le corriger

  • Upgrade OpenSSL to a fixed version (1.0.1g or later for the affected branch), and find every instance, including copies embedded in appliances and devices.
  • Assume the server's private keys leaked: re-issue and replace all TLS certificates and revoke the old ones, because patching alone does not undo a key that may already be stolen.
  • Force password resets and invalidate session tokens, since credentials and cookies may have been read from memory.

Comment l’éviter

  • Prefer memory-safe languages for code that parses untrusted input; a whole class of over-read and overflow bugs simply cannot happen in them.
  • Fuzz-test and audit C and C++ that touches the network, and never trust a length field from the other side without checking it against the data you actually received.
  • Keep an inventory of where critical libraries like OpenSSL run, including embedded copies, so the next flaw can be patched in hours.
  • Support and fund the open-source projects your security depends on; Heartbleed lived in code maintained by a handful of unpaid volunteers.

Références

Vulnérabilités liées

Tout Infra →