Heartbleed (CVE-2014-0160)

Heartbleed is the informal name for CVE-2014-0160, a critical vulnerability in the OpenSSL cryptographic library's implementation of the TLS/DTLS "heartbeat" extension. A missing bounds check in the heartbeat request-handling code allowed a remote, unauthenticated attacker to send a malformed heartbeat request and receive back up to 64 kilobytes of the server's process memory, with no trace left in logs. Repeated requests could gradually leak private keys, session cookies, passwords, and other sensitive data held in memory.

Origin of the bug

The flawed code was introduced into the OpenSSL source repository on December 31, 2011, by Robin Seggelmann, a doctoral student who had implemented the heartbeat feature; a fellow OpenSSL developer, Stephen N. Henson, reviewed the change but did not catch the missing bounds check. The flaw first shipped in a stable release with OpenSSL 1.0.1 on March 14, 2012, and remained present through version 1.0.1f, meaning the vulnerable code was in wide production use for over two years before discovery.

Discovery and disclosure

Heartbleed was found independently by two parties within days of each other in early April 2014. Neel Mehta, a security engineer on Google's security team, discovered the bug and reported it to the OpenSSL team on April 1, 2014. Separately, researchers identified only as Riku, Antti, and Matti at the Finnish security firm Codenomicon discovered the same flaw around April 3, 2014, while testing their own software. Codenomicon gave the vulnerability its "Heartbleed" name and a bleeding-heart logo, then built the site heartbleed.com to explain the bug to a non-technical audience — an unusually public branding effort for a software vulnerability. The OpenSSL project publicly disclosed the flaw and released the fixed version, OpenSSL 1.0.1g, on April 7, 2014. Some organizations reportedly patched before this public disclosure date; contemporary press coverage noted it was not always clear how those organizations learned of the bug in advance, and the fairness and scope of any early or selective notification remains disputed.

Impact and scale

Because OpenSSL was the default TLS library for Apache and nginx — together serving a majority of active websites at the time — Heartbleed was assessed at disclosure as affecting roughly 17% of the internet's SSL-protected servers, on the order of 500,000 systems. Services reported as affected included Yahoo, Imgur, Stack Overflow, Slate, DuckDuckGo, Reddit, Tumblr, GitHub, Pinterest, and Wikimedia Foundation sites. A follow-up scan on June 21, 2014 still found 309,197 public servers unpatched.

Response

Remediation required not just patching OpenSSL but also revoking and reissuing TLS certificates and rotating any credentials that might have been exposed, since patching alone could not undo an earlier leak. Cloudflare mass-revoked certificates, an operation with significant added infrastructure cost; the Tor Project urged relay operators to regenerate their keys; and Canada's tax agency briefly took online services offline as a precaution. Security commentators, including Bruce Schneier, described Heartbleed in the most severe terms used for a software vulnerability up to that point, and Forbes contributor Joseph Steinberg wrote that it might be "the worst vulnerability found ... since commercial traffic began flowing on the Internet."

Timeline

• 2011-12-31Robin Seggelmann's heartbeat-extension code, containing the missing bounds check that causes Heartbleed, is committed to the OpenSSL source repository.
• 2012-03-14OpenSSL 1.0.1 is released as the first stable version containing the vulnerable heartbeat code.
• 2014-04-01Neel Mehta of Google's security team discovers the bug and reports it to the OpenSSL team.
• 2014-04-03Researchers at Codenomicon (Riku, Antti, and Matti) independently discover the same vulnerability.
• 2014-04-07Heartbleed is publicly disclosed, OpenSSL 1.0.1g is released fixing the flaw, and heartbleed.com is launched by Codenomicon.
• 2014-06-21A follow-up internet scan finds 309,197 public servers still vulnerable to Heartbleed.