Double Free in GnuTLS - CVE-2022-2509

Vulnerability identifier: #VU65915

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2509

CWE-ID: CWE-415

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within gnutls_pkcs7_verify() function when verifying the pkcs7 signatures. A remote attacker can pass specially crafted data to the application, trigger a double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GnuTLS
Debian Linux
Gentoo Linux
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Oracle Linux
Oracle Solaris
Slackware Linux
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Fedora
cflinuxfs3
IBM supplied MQ Advanced container images
ObjectScale
PowerStore T
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak
Submariner
Service Binding Operator
NetObserv Operator
Data Lakehouse
Migration Toolkit for Runtimes
IBM MQ Operator
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Object Storage Systems
OpenShift Logging
Oracle Communications Cloud Native Core Binding Support Function
Custom Metrics Autoscaler Operator for Red Hat OpenShift
IBM Cloud Transformation Advisor
Red Hat OpenShift Dev Spaces
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenShift Serverless
OpenShift sandboxed containers
OpenShift Virtualization
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
HPE Moonshot 1500 Chassis Manager
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libgnutls30 (Ubuntu package)
libgnutls30
gnutls
gnutls-debuginfo
gnutls-debugsource
libgnutls-devel
libgnutls30-hmac-32bit
libgnutls30-debuginfo
libgnutls30-hmac
libgnutlsxx-devel
libgnutlsxx28
libgnutlsxx28-debuginfo
libgnutls30-32bit
libgnutls30-32bit-debuginfo
libgnutls-devel-32bit
gnutls-guile
gnutls-guile-debuginfo
gnutls-help
gnutls-devel
gnutls (Red Hat package)
gnutls-utils
gnutls-dane
gnutls-c++
gnutls28 (Debian package)
nettle (Red Hat package)
net-libs/gnutls
Voice Gateway
Cloud Pak for Security (CP4S)
Dell EMC VxRail Appliance

Install updates from vendor's website.

GnuTLS - update to 3.7.7
cflinuxfs3 - update to 0.313.0
Submariner - update to 0.14.0
Service Binding Operator - update to 1.3.1
NetObserv Operator - update to 1.1.0
Red Hat OpenShift Serverless - addressed in versions 1.26.0, 1.27.0
Data Lakehouse - update to 1.1.0.0
Migration Toolkit for Runtimes - update to 1.0.1
OpenShift API for Data Protection (OADP) - update to 1.1.1
OpenShift sandboxed containers - update to 1.4.1
Migration Toolkit for Containers - update to 1.7.6
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.4.8, 2.6.2, 2.6.4
IBM Cloud Object Storage Systems - update to 3.16.7.63
Red Hat OpenShift Container Platform - addressed in versions 4.11.12, 4.13.0
OpenShift Logging - addressed in versions 5.3.13, 5.3.14, 5.4.8, 5.5.4, 5.5.5
IBM supplied MQ Advanced container images - update to 9.3.0.1-r3
Voice Gateway - addressed in versions 1.0.8.1, 1.0.8.2, 1.0.8.5
ObjectScale - update to 1.4.0
Cloud Pak for Security (CP4S) - update to 1.10.12.0
Custom Metrics Autoscaler Operator for Red Hat OpenShift - update to 2.12.1-376
IBM Cloud Transformation Advisor - update to 3.4.0
PowerStore T - update to 3.5.0.1-2083289
libgnutls30 (Ubuntu package) - addressed in versions 3.5.18-1ubuntu1.6, 3.6.13-2ubuntu1.7, 3.7.3-4ubuntu1.1
IBM Cloud Pak for Watson AIOps - update to 3.6.1
libgnutls30 - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls-debuginfo - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls-debugsource - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls-devel - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls30-hmac-32bit - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls30-debuginfo - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls30-hmac - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutlsxx-devel - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutlsxx28 - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutlsxx28-debuginfo - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls30-32bit - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls30-32bit-debuginfo - addressed in versions 3.6.7-150000.6.45.2, 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
libgnutls-devel-32bit - addressed in versions 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls-guile - addressed in versions 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls-guile-debuginfo - addressed in versions 3.6.7-150200.14.19.2, 3.7.3-150400.4.10.1
gnutls-help - update to 3.6.14-8
gnutls-debugsource - update to 3.6.14-8
gnutls - update to 3.6.14-8
gnutls-debuginfo - update to 3.6.14-8
gnutls-devel - update to 3.6.14-8
gnutls (Red Hat package) - addressed in versions 3.6.16-5.el8_6, 3.7.6-12.el9_0
gnutls-utils - update to 3.6.16-5.0.1
gnutls-devel - update to 3.6.16-5.0.1
gnutls-dane - update to 3.6.16-5.0.1
gnutls-c++ - update to 3.6.16-5.0.1
gnutls - update to 3.6.16-5.0.1
gnutls28 (Debian package) - update to 3.7.1-5+deb11u2
gnutls - addressed in versions 3.7.7-1.fc35, 3.7.7-1.fc36
nettle (Red Hat package) - update to 3.8-3.el9_0
net-libs/gnutls - update to 3.8.5
Red Hat OpenShift Dev Spaces - update to 3.15.0
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.6.4
OpenShift Virtualization - addressed in versions 4.11.1, 4.12.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
Dell EMC VxRail Appliance - addressed in versions 7.0.401, 8.0.000
Robotic Process Automation for Cloud Pak - update to 21.0.7

• https://access.redhat.com/security/cve/CVE-2022-2509
• https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html

• Remote code execution in GnuTLS
• Slackware Linux update for gnutls
• Ubuntu update for gnutls28
• Multiple vulnerabilities in cflinuxfs3
• Debian update for gnutls28
• SUSE update for gnutls
• SUSE update for gnutls
• SUSE update for gnutls
• Multiple vulnerabilities in IBM Cloud Object Storage Systems
• Multiple vulnerabilities in IBM Cloud Object Storage Systems
• Red Hat Enterprise Linux 9 update for gnutls and nettle
• Oracle Solaris update for third-party software
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8 update for gnutls
• Multiple vulnerabilities in Dell VxRail
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.4
• Multiple vulnerabilities in OpenShift Container Platform 4.11
• Multiple vulnerabilities in Red Hat Advanced Cluster Management 2.6
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in OpenShift Logging 5.5
• Multiple vulnerabilities in Service Binding Operator
• Multiple vulnerabilities in Red Hat OpenShift Logging 5.4
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.1
• Multiple vulnerabilities in IBM MQ Operator
• Multiple vulnerabilities in OpenShift Virtualization 4.11
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in OpenShift Logging 5.5
• Multiple vulnerabilities in OpenShift Serverles
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in Dell VxRail Appliance components
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Binding Support Function
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in OpenShift Virtualization 4.12
• Multiple vulnerabilities in Migration Toolkit for Runtimes
• Multiple vulnerabilities in Submariner
• Multiple vulnerabilities in OpenShift Serverless
• Red Hat Advanced Cluster Management for Kubernetes 2.6 update for Submariner
• Multiple vulnerabilities in NetObserv Operator
• Double free in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in OpenShift Container Platform 4.13
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in Dell PowerStore Family
• openEuler update for gnutls
• Multiple vulnerabilities in Custom Metrics Autoscaler Operator for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Dell Data Lakehouse System Software
• Multiple vulnerabilities in Dell ObjectScale
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager
• Fedora 36 update for gnutls
• Fedora 35 update for gnutls
• Anolis OS update for gnutls
• Gentoo update for GnuTLS