GnuTLS Double-Free Vulnerability in Subject Alternative Name Export Logic

A double-free vulnerability has been identified in GnuTLS, arising from improper ownership management in the export process of Subject Alternative Name (SAN) entries that include an otherName. When an invalid or malformed type-id OID is present, GnuTLS erroneously calls asn1_delete_structure() on an ASN.1 node it does not own. This mismanagement creates a double-free condition, as the parent function or caller subsequently attempts to free the same structure. The vulnerability can be exploited using public GnuTLS APIs, potentially leading to memory corruption or a denial-of-service condition, depending on the behavior of the memory allocator.

Impact

Exploitation of this vulnerability can cause a double-free condition, leading to memory corruption or a denial-of-service situation, depending on how the memory allocator handles the corrupted memory.