Loading vulnerability…
OpenSSL ASN.1 BIO Parsing Memory Exhaustion
CVE-2016-2109 is an input-validation vulnerability in OpenSSL's ASN.1 BIO decoding implementation, specifically the asn1_d2i_read_bio function. A short, invalid ASN.1 encoding processed through BIO-based decoding functions such as d2i_CMS_bio() can trigger disproportionately large memory allocations, potentially exhausting memory and causing denial of service. Affected upstream releases include OpenSSL before 1.0.1t and the 1.0.2 branch before 1.0.2h. Applications processing untrusted ASN.1 data through d2i BIO functions are affected; memory-based decoding functions such as d2i_X509() are not. OpenSSL's TLS implementation is not affected because it uses memory-based ASN.1 parsing.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can force an affected application to allocate excessive memory, degrading availability or exhausting available memory and causing denial of service. Resource exhaustion may also affect other workloads sharing the system. No confidentiality or integrity impact, arbitrary code execution, or privilege escalation is established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted ASN.1 input from reaching affected BIO decoding operations where operationally feasible, and restrict access to application interfaces that expose those operations. Network restrictions help only where the affected parsing operation is remotely reachable. No general OpenSSL configuration workaround is established; disabling TLS is not a targeted mitigation because OpenSSL's TLS parsing path is unaffected.
Patch, then assume compromise.
Apply a supported vendor update containing the fix. The original upstream fixed releases are OpenSSL 1.0.1t and 1.0.2h for their respective branches. Vendor-backported fixes include OpenSSL 1.0.1e-48.el6_8.1 for RHEL 6, 1.0.1e-51.el7_2.5 for RHEL 7, and 1.0.1e-42.el6_7.5 for RHEL 6.7 EUS. Evaluate vendor package status rather than upstream version numbers alone because security fixes may be backported. Restart all services linked to the updated OpenSSL library, or reboot, for the fix to take effect. Migrate unsupported installations to supported releases.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.