CVE-2014-3509: Race Condition
A race condition was found in the sslparseserverhellotlsext() code that may result in upto 255 bytes being written to memory that had been free'd if an ec point format extension was sent by the server. This issue only affects multi-threaded clients.
Other sources
Race condition in the sslparseserverhellotlsext function in t1lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3509?
CVE-2014-3509 is considered a medium severity vulnerability due to its potential for memory corruption in multi-threaded OpenSSL clients.
How do I fix CVE-2014-3509?
To fix CVE-2014-3509, upgrade OpenSSL to at least version 1.0.1h or later.
Who is affected by CVE-2014-3509?
CVE-2014-3509 affects multi-threaded clients using OpenSSL versions 1.0.0 and 1.0.1 prior to 1.0.1h.
What causes CVE-2014-3509?
CVE-2014-3509 is caused by a race condition in the ssl_parse_serverhello_tlsext() function when handling ec point format extensions.
Is CVE-2014-3509 exploitable?
Yes, CVE-2014-3509 can be exploited to potentially write to freed memory, leading to undefined behavior in affected applications.