Silent Patches & Memory Leaks: Analyzing HollowByte in OpenSSL

Has anyone dug into the HollowByte report from Okta? It’s insane that an 11-byte TLS request can permanently lock 131KB of memory on unpatched glibc systems. What’s worse is that OpenSSL fixed this in June without a CVE or advisory. Silent patches are a nightmare for asset management.

The issue stems from how the server allocates memory for a message that never gets sent. On glibc, the allocator doesn't return that memory to the OS. If an attacker floods this, your service runs out of RAM fast.

First step: Verify your version. You need to check if you are running a version prior to the fix introduced in June (OpenSSL 3.0.x and 3.1.x are the main targets).

openssl version -a

Look for build dates prior to the fix or check the specific commit history. Since there is no CVE, traditional scanners (Nessus, Qualys) might miss this specific flag.

For those running IDS, you might need to look at anomalous TLS handshake patterns. Here is a basic Python logic snippet to illustrate what to look for in logs:

# Pseudo-code for log analysis
if packet_length == 11 and tls_state == 'WAITING_FOR_MESSAGE':
    alert_hollowbyte_pattern(src_ip)

How are you guys handling silent patches like this? Do we need to start automating commit monitoring for critical libraries now?