CVE-2025-32988: Gnutls: vulnerability in gnutls othername san export
A double-free vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
Other sources
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.
This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.9-2+deb12u5 - Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.8.9-3 - Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32988?
CVE-2025-32988 has been categorized as a high severity vulnerability due to the potential for remote code execution from the double-free condition.
How do I fix CVE-2025-32988?
To fix CVE-2025-32988, it is recommended to update GnuTLS to the latest version where this vulnerability has been addressed.
What specific component of GnuTLS is affected by CVE-2025-32988?
CVE-2025-32988 specifically affects the export logic of Subject Alternative Name (SAN) entries in GnuTLS.
What could an attacker achieve by exploiting CVE-2025-32988?
An attacker exploiting CVE-2025-32988 could potentially execute arbitrary code on the affected system.
Is CVE-2025-32988 a local or remote vulnerability?
CVE-2025-32988 is primarily considered a remote vulnerability, as it can be exploited over the network.