DTLS Session ID Length Validation OOB Read in OpenSSL

Executive Summary

This is a DTLS (Datagram Transport Layer Security) vulnerability where an unauthenticated peer exploits incorrect length validation in the ClientHello packet. The parser reads a claimed session_id length and checks the ciphersuite length against the total record instead of remaining bytes, causing an out-of-bounds (OOB) read of up to 255 bytes. These bytes are then echoed in the ServerHello, leaking adjacent process memory over the network.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to read sensitive memory from the vulnerable system, potentially exposing confidential data like credentials, keys, or other secrets. The crash variant may cause denial-of-service by terminating the service on the first packet.

Useful 0 Not Useful 0

Mitigation Strategies

Update or patch the affected DTLS implementation to fix the session_id length validation and memory disclosure issue. Disable DTLS if not required or restrict network access to vulnerable services until patched.

Useful 0 Not Useful 0