Heartbleed (CVE-2014-0160)

Heartbleed is a missing bounds check in OpenSSL's implementation of the TLS/DTLS heartbeat extension (RFC 6520). It affected OpenSSL 1.0.1 through 1.0.1f and was fixed in 1.0.1g, released in April 2014. A heartbeat request carries a payload and a claimed length; vulnerable versions echoed back as many bytes as the length claimed, up to about 64 KB, regardless of the real payload size. Each request leaked a different chunk of process memory, without authentication and without leaving traces in normal logs. It was found independently by Neel Mehta of Google Security and by engineers at Codenomicon.

Why it matters

Leaked memory could contain session cookies, passwords and, in some cases, the server's private key; researchers demonstrated key extraction from a test server shortly after disclosure. Because exploitation left no record, operators had to assume compromise. The correct response was therefore more than patching OpenSSL: generate new keys, obtain new certificates and revoke the old ones, invalidate sessions and ticket keys, and ask users to change passwords. Heartbleed also showed how much of the internet depended on a thinly funded open source project, and prompted new funding efforts such as the Linux Foundation's Core Infrastructure Initiative.

Example

openssl version
# 1.0.1 through 1.0.1f: vulnerable
# 1.0.1g and later, and the 0.9.8 and 1.0.0 branches: not affected

nmap -p 443 --script ssl-heartbleed example.com

Common misconceptions

• Heartbleed was a flaw in the TLS protocol. It was an implementation bug in OpenSSL; TLS libraries with their own code were not affected.
• Upgrading OpenSSL was enough. Anything that may have leaked, private keys above all, had to be replaced, because a patch does not un-leak data.
• It is still a common risk today. Current systems have not shipped a vulnerable OpenSSL for many years; what remains are unpatched appliances and embedded devices.