GnuTLS Denial-of-Service Vulnerability via Malicious Certificates

A denial-of-service vulnerability has been identified in GnuTLS. This issue arises from excessive CPU and memory usage when processing specially crafted malicious certificates that contain a large number of name constraints and subject alternative names (SANs). The vulnerability occurs during certificate verification, leading to resource exhaustion.

Impact

Exploitation of this vulnerability causes excessive CPU and memory consumption, leading to a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by verifying a certificate chain with the certtool --verify command, using certificates that have a large number of SANs and name constraints. GnuTLS will attempt to verify all of these fields without any limit, causing increased CPU and memory usage.