var-202408-0009
Vulnerability from variot
Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause memory to be accessed that was previously freed in some situations
Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, only applications that directly call the SSL_free_buffers function are affected by this issue. Applications that do not call this function are not vulnerable. Our investigations indicate that this function is rarely used by applications.
The SSL_free_buffers function is used to free the internal OpenSSL buffer used when processing an incoming record from the network. The call is only expected to succeed if the buffer is not currently in use. However, two scenarios have been identified where the buffer is freed even when still in use.
The first scenario occurs where a record header has been received from the network and processed by OpenSSL, but the full record body has not yet arrived. In this case calling SSL_free_buffers will succeed even though a record has only been partially processed and the buffer is still in use.
The second scenario occurs where a full record containing application data has been received and processed by OpenSSL but the application has only read part of this data. Again a call to SSL_free_buffers will succeed even though the buffer is still in use.
While these scenarios could occur accidentally during normal operation a malicious attacker could attempt to engineer a stituation where this occurs. We are not aware of this issue being actively exploited.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. SCALANCE M-800, MUM-800 and S615 as well as RUGGEDCOM RM1224 are industrial routers.
Multiple Siemens products have a use-after-free vulnerability that can be exploited by an attacker to access previously freed memory. ========================================================================== Ubuntu Security Notice USN-6937-1 July 31, 2024
openssl vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in OpenSSL.
Software Description: - openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
It was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when certain non-default TLS server configurations were in use. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. (CVE-2024-2511)
It was discovered that OpenSSL incorrectly handled checking excessively long DSA keys or parameters. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-4603)
William Ahern discovered that OpenSSL incorrectly handled certain memory operations in a rarely-used API. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-4741)
Joseph Birr-Pixton discovered that OpenSSL incorrectly handled calling a certain API with an empty supported client protocols buffer. A remote attacker could possibly use this issue to obtain sensitive information, or cause OpenSSL to crash, resulting in a denial of service. (CVE-2024-5535)
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 24.04 LTS libssl3t64 3.0.13-0ubuntu3.2
Ubuntu 22.04 LTS libssl3 3.0.2-0ubuntu1.17
Ubuntu 20.04 LTS libssl1.1 1.1.1f-1ubuntu2.23
After a standard system update you need to reboot your computer to make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-6937-1 CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535
Package Information: https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.2 https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.17 https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.23
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202408-0009",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "scalance m-800 family",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "8.2"
},
{
"model": "scalance s615 family",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "8.2"
},
{
"model": "ruggedcom rm1224 family",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "8.2"
},
{
"model": "scalance mum-800 family",
"scope": "lt",
"trust": 0.6,
"vendor": "siemens",
"version": "8.2"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ubuntu",
"sources": [
{
"db": "PACKETSTORM",
"id": "179880"
}
],
"trust": 0.1
},
"cve": "CVE-2024-4741",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.8,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "CNVD-2024-45212",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2024-4741",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"id": "CVE-2024-4741",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2024-45212",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code. \nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications. \n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use. \n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived. \nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use. \n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use. \n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs. \nWe are not aware of this issue being actively exploited. \n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. SCALANCE M-800, MUM-800 and S615 as well as RUGGEDCOM RM1224 are industrial routers. \n\nMultiple Siemens products have a use-after-free vulnerability that can be exploited by an attacker to access previously freed memory. ==========================================================================\nUbuntu Security Notice USN-6937-1\nJuly 31, 2024\n\nopenssl vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 24.04 LTS\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in OpenSSL. \n\nSoftware Description:\n- openssl: Secure Socket Layer (SSL) cryptographic library and tools\n\nDetails:\n\nIt was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when\ncertain non-default TLS server configurations were in use. A remote\nattacker could possibly use this issue to cause OpenSSL to consume\nresources, leading to a denial of service. (CVE-2024-2511)\n\nIt was discovered that OpenSSL incorrectly handled checking excessively\nlong DSA keys or parameters. A remote attacker could possibly use this\nissue to cause OpenSSL to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. \n(CVE-2024-4603)\n\nWilliam Ahern discovered that OpenSSL incorrectly handled certain memory\noperations in a rarely-used API. A remote attacker could use this issue to\ncause OpenSSL to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. (CVE-2024-4741)\n\nJoseph Birr-Pixton discovered that OpenSSL incorrectly handled calling a\ncertain API with an empty supported client protocols buffer. A remote\nattacker could possibly use this issue to obtain sensitive information, or\ncause OpenSSL to crash, resulting in a denial of service. (CVE-2024-5535)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 24.04 LTS\n libssl3t64 3.0.13-0ubuntu3.2\n\nUbuntu 22.04 LTS\n libssl3 3.0.2-0ubuntu1.17\n\nUbuntu 20.04 LTS\n libssl1.1 1.1.1f-1ubuntu2.23\n\nAfter a standard system update you need to reboot your computer to make all\nthe necessary changes. \n\nReferences:\n https://ubuntu.com/security/notices/USN-6937-1\n CVE-2024-2511, CVE-2024-4603, CVE-2024-4741, CVE-2024-5535\n\nPackage Information:\n https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.2\n https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.17\n https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.23\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2024-4741"
},
{
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"db": "PACKETSTORM",
"id": "179880"
}
],
"trust": 1.53
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2024-4741",
"trust": 1.7
},
{
"db": "SIEMENS",
"id": "SSA-354112",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2024-45212",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "179880",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"db": "PACKETSTORM",
"id": "179880"
},
{
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"id": "VAR-202408-0009",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
}
]
},
"last_update_date": "2024-11-20T19:54:38.387000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Post-release reuse vulnerabilities in multiple Siemens products",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/617371"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-416",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.0,
"url": "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177"
},
{
"trust": 1.0,
"url": "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d"
},
{
"trust": 1.0,
"url": "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac"
},
{
"trust": 1.0,
"url": "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8"
},
{
"trust": 1.0,
"url": "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4"
},
{
"trust": 1.0,
"url": "https://www.openssl.org/news/secadv/20240528.txt"
},
{
"trust": 0.6,
"url": "https://cert-portal.siemens.com/productcert/html/ssa-354112.html"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.2"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-4741"
},
{
"trust": 0.1,
"url": "https://ubuntu.com/security/notices/usn-6937-1"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.17"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-4603"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-5535"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2024-2511"
},
{
"trust": 0.1,
"url": "https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.23"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"db": "PACKETSTORM",
"id": "179880"
},
{
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"db": "PACKETSTORM",
"id": "179880"
},
{
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"date": "2024-08-01T10:11:11",
"db": "PACKETSTORM",
"id": "179880"
},
{
"date": "2024-11-13T11:15:04.480000",
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2024-11-18T00:00:00",
"db": "CNVD",
"id": "CNVD-2024-45212"
},
{
"date": "2024-11-13T17:01:16.850000",
"db": "NVD",
"id": "CVE-2024-4741"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "179880"
}
],
"trust": 0.1
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Post-release reuse vulnerabilities in multiple Siemens products",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2024-45212"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.