A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting messagelength values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption.

A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically for dNSName (DNS) or rfc822Name (email) constraints within excludedSubtrees or permittedSubtrees. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure.

A flaw was found in gnutls. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted ClientHello message with an invalid Pre-Shared Key (PSK) binder value during the TLS handshake. This can lead to a NULL pointer dereference, causing the server to crash and resulting in a remote Denial of Service (DoS) condition.

Summarysummary A malicious TLS client can trigger a NULL pointer dereference on the server by sending a crafted ClientHello message with an invalid PSK binder value. This leads to a server crash and constitutes a remote Denial-of-Service condition.

Technical Detailstechnical-details The issue occurs during PSK binder verification in the server-side code path.

In presharedkey.c, when the server receives a presharedkey extension, the function gnutlspskrecvparams() is invoked. Under certain conditions, the following logic is executed:

pskcred = (gnutlspskservercredentialst) gnutlsgetcred(session, GNUTLSCRDPSK); if (pskcred == NULL && (session->internals.flags & GNUTLSNOTICKETS)) return 0; return serverrecvparams(session, data, len, pskcred); When the server issues a NewSessionTicket and the client later sends a ClientHello using the ticket identity from that message, gnutlsgetcred() returns NULL. However, in this scenario the conditional check above does not return early, and pskcred (which is NULL) is passed to serverrecvparams().

Inside serverrecvparams(), the PSK binder value is verified. If the received binder size matches the PRF MAC length but the binder value itself is incorrect, the following code path is taken:

if (gnutlsmacgetalgolen(prf) != binderrecvd.size || gnutlsmemcmp(bindervalue, binderrecvd.data, binderrecvd.size)) { if (pskcred->binderalgo == NULL && mac == GNUTLSMACSHA384) { mac = GNUTLSMACSHA256; gnutlsfreekeydatum(&key); goto retrybinder; } gnutlsassert(); ret = GNUTLSERECEIVEDILLEGALPARAMETER; goto fail; } At this point, pskcred is NULL, and dereferencing pskcred->binderalgo results in a NULL pointer dereference and crashes the server.

Security Impactsecurity-impact An unauthenticated remote client can reliably crash a gnuTLS-based TLS server by sending a malformed ClientHello with incorrect PSK binder values. This constitutes a remote Denial-of-Service vulnerability.

Proof of Conceptproof-of-concept Due to ongoing research constraints, I am unable to publicly disclose the PoC at this time. However, I can provide a minimal Python-based PoC privately upon request to assist with verification and debugging.

Priority Argument Settingspriority-argument-settings For completeness, the following priority string was used in my test environment: This priority configuration is specific to my research and experimental setup. However, the NULL pointer dereference does not depend on this particular priority string. In a more typical configuration, as long as the server issues a NewSessionTicket and a malicious client subsequently sends a ClientHello that references the ticket identity with an invalid PSK binder, the same NULL pointer dereference condition can still be triggered.

In other words, the issue is inherent to the server-side PSK binder handling logic and is not limited to this experimental priority configuration.

A double-free vulnerability exists in GnuTLS (confirmed in version 3.8.9) due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1deletestructure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.