Interactive OpenSSL Heartbleed Buffer Overread Visualizer (CVE-2014-0160)

In-browser interactive memory model and packet simulator demonstrating how unvalidated TLS Heartbeat length fields trigger adjacent server heap memory overreads.

💡 Plain English Explainer (ELI5)

Imagine sending a single 4-letter word 'BIRD' to a trained parrot and saying: 'Repeat back my 4-letter word, but make your answer 64,000 letters long.' The parrot squawks 'BIRD' and then immediately starts babbling the next 63,996 letters stored in its recent memory—including secret passwords, private SSL keys, and personal messages spoken by other visitors. In Heartbleed, OpenSSL trusted the client's claimed message length without checking how long the packet actually was, copying raw server memory straight back to the attacker.

Core Concepts & Subsystem Terms

TLS Heartbeat Extension: RFC 6520 keep-alive protocol mechanism used to test secure communication channels without full renegotiation.
Payload Length Field: A 16-bit unsigned integer in the heartbeat header declaring the byte length of the incoming payload (up to 65,535 bytes).
Buffer Overread: A memory safety vulnerability where an application reads past the intended boundary of a buffer into adjacent process memory.
Unbounded memcpy(): Invoking memory copy operations using a length parameter derived from untrusted client input rather than verified allocated record size.

Step-by-Step Exploit & Execution Mechanics

Malformed Heartbeat Request Dispatched

Attacker connects to TLS server and sends a Heartbeat Request containing a 1-byte payload ('A') with length field set to 0xFFFF (65,535 bytes).

Missing Payload Bounds Validation

OpenSSL reads 16-bit length via n2s(p, payload) without verifying that 1 + 2 + payload + 16 <= rrec.length.

64KB Response Buffer Allocation

Server allocates a full 64KB response buffer based on the client's claimed size and prepares the reply header.

Out-of-Bounds Memory Leak Exfiltrated

Server executes memcpy(), overreading 64KB past the 1-byte packet into adjacent heap memory and returning private keys and session tokens.

Source Code Diff: Bounds Validation in tls1_process_heartbeat()

UNPATCHED FLAW: MISSING PAYLOAD BOUNDS CHECK IN OPENSSL 1.0.1f

/* Read 16-bit length directly from client packet without bounds check */
n2s(p, payload);
pl = p;

/* Allocate reply buffer based on client's claimed size */
buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;

/* BUG: Copies up to 64KB of adjacent server heap memory! */
memcpy(bp, pl, payload);
r = ssl3_write_bytes(s, TLS1_RT_HEARTBEAT, buffer, 3 + payload + padding);

HARDENED PATCH: STRICT RECORD LENGTH BOUNDS CHECK (RFC 6520)

/* Read 16-bit length from packet */
n2s(p, payload);
pl = p;

/* FIX: Validate that claimed payload does not exceed actual received record length */
if (1 + 2 + payload + 16 > s->s3->rrec.length)
    return 0; /* Silently discard malformed heartbeat */

buffer = OPENSSL_malloc(1 + 2 + payload + padding);
bp = buffer;
memcpy(bp, pl, payload);

Engineering & System Hardening Checklist

✓ Upgrade OpenSSL to 1.0.1g or newer with strict packet length bounds checks.
✓ Revoke and reissue all SSL/TLS private certificates that were active during the vulnerable window.
✓ Force session invalidation and rotate all user passwords and API session tokens.
✓ Enable AddressSanitizer (ASan) in continuous integration pipelines for memory safety verification.
✓ Disable the TLS Heartbeat extension compile-time flag (-DOPENSSL_NO_HEARTBEATS) if unneeded.

← All Simulators Read Full Heartbleed CVE-2014-0160 Teardown →