Heartbleed, OpenSSL TLS Heartbeat memory disclosure
The TLS and DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Overview
CVE-2014-0160, widely known as Heartbleed, is a critical buffer over-read vulnerability in OpenSSL's implementation of the TLS/DTLS Heartbeat extension (RFC 6520). The flaw allows remote attackers to extract up to 64 KB of process memory per malicious request from any vulnerable TLS-terminating server. This vulnerability is considered one of the most significant security flaws in internet history due to OpenSSL's ubiquitous deployment across web servers, VPNs, and countless networked devices.
Technical Details
The vulnerability exists in how OpenSSL 1.0.1 through 1.0.1f handles Heartbeat Extension packets. The Heartbeat mechanism is a keep-alive feature where a client sends a message containing payload data and declares its length; the server then echoes back the same data.
The critical flaw is that OpenSSL trusted the caller's claimed payload length without validating that the actual data matched that length. An attacker could send a heartbeat request claiming a payload of 64 KB (65,535 bytes) while only providing 1 byte of actual data. The server would respond with that 1 byte plus 65,534 bytes of adjacent process memory.
The vulnerable code resided in d1_both.c (DTLS) and t1_lib.c (TLS). The bug was introduced in OpenSSL 1.0.1-beta1 (December 2011) and remained undetected in production for over two years until its public disclosure in April 2014.
Impact
The leaked memory could contain highly sensitive data including:
- Private TLS keys used for encryption and signing
- Session keys for active TLS connections from other users
- Authentication tokens and cookies from HTTP requests
- Credentials including usernames and passwords from POST bodies
- Database passwords and other configuration secrets
Attackers could repeat requests thousands of times, harvesting different memory slices to reconstruct sensitive data. The ability to extract private keys meant attackers could decrypt past captured traffic (if not using forward secrecy) and impersonate servers.
Mitigation
- Upgrade OpenSSL to version 1.0.1g or later immediately
- Revoke and reissue all TLS certificates on affected systems
- Rotate all credentials that may have been exposed (API keys, passwords, session tokens)
- Inventory legacy systems, old appliances, IoT devices, and load balancers may still run vulnerable versions
- Replace end-of-life devices that cannot be patched
Detection
Detection methods include:
- Network-based detection of malformed heartbeat requests with mismatched payload lengths
- Version checking of OpenSSL installations (
openssl version) - Specialized scanning tools developed post-disclosure (e.g., Nmap scripts, Metasploit modules)
- Monitoring for unusual memory access patterns in TLS processes