CVE-2022-2509: 
NixOS vulnerability analysis and mitigation

A double-free vulnerability (CVE-2022-2509) was discovered in GnuTLS, a library implementing the TLS and SSL protocols. The vulnerability was found in versions 3.6.0 to 3.7.6 and was disclosed on July 28, 2022. The security flaw occurs during verification of PKCS7 signatures in the gnutlspkcs7verify function (GnuTLS Help, Ubuntu CVE).

The vulnerability is caused by a double-free error that occurs during the verification of PKCS7 signatures specifically in the gnutlspkcs7verify function. The issue has been assigned a CVSS 3.1 base score of 7.5 (High), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and affecting only availability (Ubuntu CVE).

A remote attacker could exploit this vulnerability to cause applications using the GnuTLS library to crash, resulting in a denial of service condition. Additionally, there was potential for arbitrary code execution (Debian Security).

The vulnerability was fixed in GnuTLS version 3.7.7, released on July 28, 2022. Various Linux distributions have released security updates to address this issue: Ubuntu has fixed it in versions 3.7.7-2ubuntu1 (22.10), 3.7.3-4ubuntu1.1 (22.04 LTS), 3.6.13-2ubuntu1.7 (20.04 LTS), and 3.5.18-1ubuntu1.6 (18.04 LTS). Debian has addressed it in version 3.7.1-5+deb11u2 for the stable distribution (GnuTLS Help, Ubuntu CVE).