Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 831573 (GNUTLS-SA-2022-01-17) - <net-libs/gnutls-3.7.3: Memory corruption in gnutls_x509_trust_list_verify_crt2()
Summary: <net-libs/gnutls-3.7.3: Memory corruption in gnutls_x509_trust_list_verify_cr...
Status: IN_PROGRESS
Alias: GNUTLS-SA-2022-01-17
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://gitlab.com/gnutls/gnutls/-/is...
Whiteboard: B3 [glsa? cleanup]
Keywords:
Depends on: 834462
Blocks:
  Show dependency tree
 
Reported: 2022-01-20 11:24 UTC by Sam James
Modified: 2022-05-19 18:19 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2022-01-20 11:24:57 UTC
"When a single trust list object is shared among multiple threads, calls to gnutls_x509_trust_list_verify_crt2() was able to corrupt temporary memory where internal copy of an issuer certificate is stored. The code path is only taken when a PKCS#11 based trust store is enabled and the issuer certificate is already stored as trusted. The issue was reported in the issue tracker as #1277.
Recommendation: To address the issue found upgrade to GnuTLS 3.7.3 or later versions."

See https://gitlab.com/gnutls/gnutls/-/issues/1277.
Comment 1 Larry the Git Cow gentoo-dev 2022-01-20 12:08:30 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cd7f6673d01d4af7f1bcc9b3ca707b98d679cd5c

commit cd7f6673d01d4af7f1bcc9b3ca707b98d679cd5c
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2022-01-20 11:39:16 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2022-01-20 12:02:04 +0000

    net-libs/gnutls: add 3.7.3
    
    Bug: https://bugs.gentoo.org/831573
    Signed-off-by: Sam James <sam@gentoo.org>

 net-libs/gnutls/Manifest            |   1 +
 net-libs/gnutls/gnutls-3.7.3.ebuild | 127 ++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-05-19 18:19:40 UTC
Please cleanup