OpenSSL: NULL dereference crashes a TLSv1.2 server on a crafted renegotiation ClientHello

CVSS 5.9CVE-2021-3449Kernel, userspace & hypervisorcurated

Impact

A renegotiation ClientHello that omits signature_algorithms while including signature_algorithms_cert dereferences NULL and takes the server process down. Any OpenSSL 1.1.1 server with TLSv1.2 and renegotiation enabled is affected, which was the default configuration - that covers a lot of what listens on a GPU fleet: cluster API endpoints, metrics and logging collectors, registries, management web services. No authentication and no prior handshake success is needed, so a single tenant-reachable listener can be killed repeatedly until it is patched. Clients are not affected, and the issue is availability only - no key or data disclosure.

Who can reach it

Anyone who can open a TLS connection to an affected server and complete a handshake far enough to renegotiate. No authentication required. Exposure is whatever network the listener sits on - tenant network, management VLAN, or the internet.

What to do

Upgrade OpenSSL to 1.1.1k (or the distribution backport) and restart every service linked against it - statically linked and container-bundled copies will not pick up a host library update. OpenSSL 1.0.2 is not affected. Where an immediate upgrade is not possible, disabling TLSv1.2 renegotiation on the affected listeners removes the trigger.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-3449 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf http://www.openwall.com/lists/oss-security/2021/03/27/1

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.