CVE-2017-5334 - Double Free

Severity

75%

Complexity

99%

Confidentiality

106%

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

Double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

CVSS 3.0 Base Score 9.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 7.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P).

Demo Examples

Double Free

CWE-415

Double Free

CWE-415

While contrived, this code should be exploitable on Linux distributions which do not ship with heap-chunk check summing turned on.


               
}
free(buf1R2);

Overview

First reported 7 years ago

2017-03-24 15:59:00

Last updated 6 years ago

2018-10-30 16:27:00

Affected Software

openSUSE Leap 42.1

42.1

openSUSE Leap 42.2

42.2

GNU GnuTLS

GNU GnuTLS 3.5.0

3.5.0

GNU GnuTLS 3.5.1

3.5.1

GNU GnuTLS 3.5.2

3.5.2

GNU GnuTLS 3.5.3

3.5.3

GNU GnuTLS 3.5.4

3.5.4

GNU GnuTLS 3.5.5

3.5.5

GNU GnuTLS 3.5.6

3.5.6

GNU GnuTLS 3.5.7

3.5.7

References

openSUSE-SU-2017:0386

Third Party Advisory

[oss-security] 20170110 CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8

Mailing List, Patch, Third Party Advisory

[oss-security] 20170110 Re: CVE request: two advisories for GnuTLS GNUTLS-SA-2017-1, GNUTLS-SA-2017-2, fixed in 3.3.26, 3.5.8

Mailing List, Patch, Third Party Advisory

95370

Third Party Advisory, VDB Entry

1037576

Third Party Advisory, VDB Entry

RHSA-2017:2292

https://gitlab.com/gnutls/gnutls/commit/c5aaa488a3d6df712dc8dff23a049133cab5ec1b

Issue Tracking, Patch, Third Party Advisory

https://gnutls.org/security.html#GNUTLS-SA-2017-1

Vendor Advisory

GLSA-201702-04

Patch, Third Party Advisory, Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.