Junglewise Threat Intelligence

CVE-2024-12243: GnuTLS denial of service via inefficient DER decoding in libtasn1

CVE-2024-12243 · Severity: medium · CVSS 5.3 · Published 2025-02-10

Technologies: Gnutls, Red Hat Enterprise Linux 8. Vendors: Red Hat.

Executive brief

A performance flaw was identified in GnuTLS, a widely used security library that enables encrypted communications for many applications and operating systems. By sending a specially crafted digital certificate, a remote attacker can force the system to spend an excessive amount of time processing the data. This can cause the affected service to become slow or completely unresponsive, leading to a denial-of-service for legitimate users.

Technical details

A vulnerability exists in GnuTLS due to inefficient algorithmic complexity (CWE-407) within the libtasn1 library used for ASN.1 data processing. The root cause is an inefficient algorithm used during the decoding of DER-encoded certificate data. A remote, unauthenticated attacker can exploit this by providing a specially crafted certificate that triggers excessive CPU and memory consumption during the decoding process. This results in a denial-of-service (DoS) condition where the GnuTLS-linked application becomes unresponsive. Patches have been released by various vendors, including Red Hat and Debian, to address the issue in libtasn1 and GnuTLS.

Affected products

  • GnuTLS GnuTLS 3.6.x, 3.7.x
  • GnuTLS libtasn1
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9.2

Timeline

  • 2024-12-12: disclosed: Date based on CVE ID assignment year and subsequent reporting
  • 2025-02-10: advisory: Initial NVD publication date
  • 2025-04-22: patched: Red Hat released updates for RHEL 8
  • 2025-10-06: patched: Red Hat released updates for RHEL 9.2

References

Related threats