CVE-2020-24659: 
NixOS vulnerability analysis and mitigation

CVE-2020-24659 affects GnuTLS versions prior to 3.6.15. The vulnerability was discovered in a TLS 1.3 client implementation where a server can trigger a NULL pointer dereference if a no_renegotiation alert is sent with unexpected timing, followed by an invalid second handshake. The crash occurs in the application's error handling path, specifically when the gnutls_deinit function is called after detecting a handshake failure (GnuTLS Security, CVE Details).

The vulnerability was discovered through fuzzing and affects the TLS 1.3 client implementation in GnuTLS. The issue occurs when processing a no_renegotiation alert with unexpected timing followed by an invalid second handshake attempt. The vulnerability manifests as a NULL pointer dereference in the error handling path during the gnutls_deinit function call. The CVSS score for this vulnerability is 7.5 (High), with the vector being CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Ubuntu Security).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition by causing the application to crash. The vulnerability affects the availability of systems using GnuTLS for TLS 1.3 client connections (NetApp Security).

The vulnerability requires a malicious server to send specifically crafted TLS alerts with precise timing. The exploit can be triggered remotely without requiring user interaction or special privileges (Gentoo Security).

The recommended mitigation is to upgrade to GnuTLS version 3.6.15 or later. No alternative workarounds are available at this time. Multiple vendors have released patches for their affected products, including Ubuntu, Red Hat, Fedora, and SUSE (Ubuntu Security Notice, Red Hat Security).