CVE-2015-3196: Race Condition
ssl/s3clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers to cause a denial of service (race condition and double free) via a crafted ServerKeyExchange message.
Other sources
The following was reported by OpenSSL upstream:
If PSK identity hints are received by a multi-threaded client then the values are wrongly updated in the parent SSLCTX structure. This can result in a race condition potentially leading to a double free of the identify hint data.
This issue was fixed in OpenSSL 1.0.2d and 1.0.1p but has not been previously listed in an OpenSSL security advisory. This issue also affects OpenSSL 1.0.0 and has not been previously fixed in an OpenSSL 1.0.0 release.
OpenSSL 1.0.2 users should upgrade to 1.0.2d OpenSSL 1.0.1 users should upgrade to 1.0.1p OpenSSL 1.0.0 users should upgrade to 1.0.0t
The fix for this issue can be identified in the OpenSSL git repository by commit ids 3c66a669dfc7 (1.0.2), d6be3124f228 (1.0.1) and 1392c238657e (1.0.0).
The fix was developed by Dr. Stephen Henson of the OpenSSL development team.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3196?
CVE-2015-3196 has a severity rating that is classified as 'Medium' due to its potential to cause denial of service.
How do I fix CVE-2015-3196?
To fix CVE-2015-3196, upgrade OpenSSL to version 1.0.0t or later, 1.0.1p or later, or 1.0.2d or later.
Which versions of OpenSSL are affected by CVE-2015-3196?
OpenSSL versions 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d are affected by CVE-2015-3196.
How can CVE-2015-3196 be exploited?
CVE-2015-3196 can be exploited by remote servers inducing a denial of service through crafted server responses, leading to a race condition and double free.
Is there a workaround for CVE-2015-3196 if I cannot update immediately?
Currently, the best practice is to apply the available patches as there are no known effective workarounds for CVE-2015-3196.