CVE-2024-9355: openssl Use of Uninitialized Variable

Vulnerability summary

CVE-2024-9355 is a medium (CVSS 6.5) Use of Uninitialized Variable vulnerability in openssl. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.1% of scored vulnerabilities.

Timeline

1. 01-10-2024
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.  It is also possible to force a derived key to be all zeros instead of an unpredictable value.  This may have follow-on implications for the Go TLS stack.

• CWE-457Use of Uninitialized VariableThe code uses a variable that has not been initialized, leading to unpredictable or unintended results.