Loading vulnerability…
OpenSSL SSL_MODE_RELEASE_BUFFERS Cross-Session Injection and Denial of Service
CVE-2010-5298 is a race condition in the OpenSSL ssl3_read_bytes function affecting OpenSSL through version 1.0.1g when SSL_MODE_RELEASE_BUFFERS is enabled in a multithreaded environment. A read buffer can be released before OpenSSL has finished using it, allowing another SSL connection within the same process to reuse and overwrite that buffer. Remote attackers can exploit the resulting use-after-free to inject data across SSL sessions or cause denial of service through parsing errors, application crashes, or unexpected connection termination.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can compromise SSL/TLS stream integrity by introducing attacker-controlled data into another connection handled by the same process. It can also disrupt affected clients or servers through application crashes, parsing failures, or dropped connections. Arbitrary code execution and confidentiality loss are not established for this vulnerability.
If you can’t patch tonight, do this now.
Where supported, avoid enabling SSL_MODE_RELEASE_BUFFERS to remove a required exploitation condition. Assess third-party applications separately, even when operating-system services do not enable this mode. Restrict access to affected SSL/TLS services to trusted hosts while patches are pending. IBM Security Network Protection XGS specifically identifies disabling outbound SSL Inspection as a workaround. FreeBSD and pfSense advisories identify no direct workaround for affected applications.
Patch, then assume compromise.
Install vendor-provided OpenSSL updates or application firmware containing the fix, including backported fixes where applicable. For example, Red Hat Enterprise Linux 6 supplied corrected OpenSSL packages at version 1.0.1e-16.el6_5.14, and HP OneView supplied version 1.10. Restart every service linked to the affected OpenSSL library or reboot after updating. Independently update applications and packages that bundle their own OpenSSL libraries; updating the operating-system library alone may leave those copies vulnerable.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.