A double-free vulnerability in GnuTLS.

October 9, 2015

GnuTLS function _gnutls_x509_dn_to_string() which process Names in X.509 certificates is vulnerable to double-free due to errors. The vulnerability occurs when the caller to the vulnerable function upon receiving error from function tries to free the already freed data variable.

A remote attacker can exploit this vulnerability by sending crafted X.509 certificates containing very long values in issuer or subject Name. This can lead to double-free vulnerability. Successful exploitation can cause arbitrary code execution, while unsuccessful attempt can lead to application termination which can cause denial of service.

Dell SonicWALL has released an IPS signature to detect and block exploitation attempts targeting this vulnerability. The signature is listed below:

  • 5512 Server Application Shellcode Exploit 28