CVE-2024-4741

Summary

CVE-2024-4741 is a vulnerability in OpenSSL that allows memory to be accessed even after it has been freed. This issue can lead to data corruption, crashes, or arbitrary code execution. The vulnerability arises when the SSL_free_buffers function is called to free a buffer that is still in use. Two scenarios have been identified where this can occur: when a record has only been partially processed, or when an application has only read part of a received record. While accidental occurrences can happen, malicious attackers could intentionally exploit this vulnerability. Applications that directly call SSL_free_buffers are at risk, but those that do not are not affected. The FIPS modules in OpenSSL versions 3.3, 3.2, 3.1, and 3.0 are not affected by this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.