CVE-2025-32988: 
GnuTLS vulnerability analysis and mitigation

CVE-2025-32988 is a double-free vulnerability in GnuTLS affecting all versions prior to 3.8.10. The flaw exists in the export logic for Subject Alternative Name (SAN) entries containing an otherName field: when the type-id OID is invalid or malformed, GnuTLS incorrectly calls asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function later attempts to free the same structure. The vulnerability was reported by the OpenAI Security Research Team and disclosed on July 10–11, 2025, alongside the GnuTLS 3.8.10 release (oss-security, Red Hat CVE). It carries a CVSS v3.1 base score of 8.2 (High) per Feedly/NVD scoring, though the upstream GnuTLS project rates it as Low severity (oss-security).

The root cause is a CWE-415 (Double Free) flaw in GnuTLS's certificate parsing code. When processing an X.509 certificate containing an otherName SAN entry with an invalid or malformed type-id OID, the error-handling path in the SAN export function incorrectly calls asn1_delete_structure() on an ASN.1 node it does not own. When the parent function subsequently attempts to free the same structure during cleanup, a double-free condition occurs. The vulnerability is exploitable using only public GnuTLS APIs — no special privileges or internal access are required — making it accessible to any caller that can supply a crafted certificate for parsing (oss-security, Red Hat Bugzilla). The confirmed affected version is GnuTLS 3.8.9 and all earlier versions in the 3.8.x branch.

Depending on the memory allocator's behavior, exploitation can result in denial of service (process crash) or memory corruption. An unauthenticated remote attacker can trigger the vulnerability by presenting a certificate with a malformed otherName SAN entry to any service that uses GnuTLS for certificate processing, potentially crashing the service or corrupting heap memory in ways that could be leveraged for further exploitation. Confidentiality impact is assessed as none, while integrity impact is low and availability impact is high (Red Hat CVE, oss-security). The broad deployment of GnuTLS across Linux distributions, enterprise middleware (Red Hat Enterprise Linux 6–10, OpenShift, IBM Cloud Pak, CICS TX, Db2), and embedded systems (SteamOS, Yocto) significantly widens the attack surface.

1. Craft a malicious X.509 certificate: Generate a certificate containing a Subject Alternative Name (SAN) extension with an otherName entry whose type-id OID is invalid or malformed (e.g., a syntactically incorrect or non-existent OID value).
2. Identify a target service: Locate a network-accessible service (e.g., a TLS server or client) that uses GnuTLS prior to version 3.8.10 to parse incoming certificates during the TLS handshake or certificate verification process.
3. Deliver the malicious certificate: Present the crafted certificate to the target service during a TLS handshake (e.g., as a client certificate in mutual TLS, or as a server certificate to a GnuTLS-based client).
4. Trigger the double-free: GnuTLS's SAN export logic encounters the malformed OID, enters the error path, and calls asn1_delete_structure() on an ASN.1 node it does not own; the parent function then attempts to free the same node, triggering the double-free condition.
5. Achieve denial of service or memory corruption: Depending on the allocator, the process crashes (DoS) or heap metadata is corrupted, potentially enabling further exploitation (oss-security, Red Hat Bugzilla).

• Logs: Unexpected process crashes or segmentation faults in services using GnuTLS (e.g., gnutls-linked daemons); crash reports referencing heap corruption or double-free errors in memory allocator logs (e.g., glibc malloc abort messages such as double free or corruption).
• Process: Abnormal termination of TLS-enabled services (e.g., httpd, dovecot, slapd, or custom applications linked against libgnutls) shortly after receiving a client certificate or initiating a TLS connection to an external host.
• Network: Repeated TLS handshake attempts from the same source IP that result in service crashes; unusual certificates presented during TLS negotiation containing malformed SAN extensions (detectable via network inspection tools such as Wireshark or TLS-aware IDS signatures).
• File System: Core dump files generated by GnuTLS-linked processes in /var/crash/, /tmp/, or application working directories following unexpected termination.

The primary remediation is to upgrade GnuTLS to version 3.8.10 or later, which contains the official fix (oss-security). Red Hat has issued security advisories for affected RHEL versions: RHSA-2025:16115 (RHEL 10), RHSA-2025:16116 (RHEL 9), RHSA-2025:17348 (RHEL 9.4 EUS), RHSA-2025:17361 (RHEL 9.2 SAP), RHSA-2025:17415 (RHEL 8), and RHSA-2025:17562 (Red Hat Errata, Red Hat Bugzilla). IBM has released iFixes for affected Cloud Pak for Business Automation, CICS TX Standard, Rapid Infrastructure Automation, and Db2 on Cloud Pak for Data products (IBM CICS TX). Oracle addressed the vulnerability in its January 2026 Critical Patch Update (Oracle CPU). No configuration-based workaround is available; patching is the only effective mitigation.

The vulnerability was discovered by the OpenAI Security Research Team as part of their Codex Security automated scanning initiative, which scanned 1.2 million code commits and identified over 10,000 high-severity issues across open-source projects including GnuTLS (oss-security). This discovery received notable coverage in security media, with outlets such as The Hacker News and Rescana highlighting the role of AI-assisted vulnerability research in finding memory safety issues in foundational cryptographic libraries. The Slackware community discussed the GnuTLS update on Reddit, and multiple Linux distribution security teams (Fedora, Debian, Ubuntu, openSUSE, AlmaLinux, Oracle Linux) issued advisories and updated packages promptly following the upstream release.