An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing and then an invalid second handshake occurs. The crash happens in the application's error handling path where the gnutls_deinit function is called after detecting a handshake failure.

🗓️ 17 Sep 2020 07:00:00Reported by MicrosoftType

GnuTLS before 3.6.15 allows a TLS 1.3 client NULL pointer dereference after no renegotiation timing and an invalid second handshake, causing deinit crash.

Reporter	Title	Published	Views	Family All 90
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security has several security vulnerabilities addressed in the latest version	30 Jul 202107:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
FreeBSD	GnuTLS -- null pointer dereference	4 Sep 202000:00	–	freebsd
Tenable Nessus	Alibaba Cloud Linux 3 : 0008: gnutls (ALINUX3-SA-2021:0008)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : gnutls (ALSA-2020:5483)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : gnutls (CESA-2020:5483)	1 Feb 202100:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP8 : gnutls (EulerOS-SA-2020-2310)	2 Nov 202000:00	–	nessus
Tenable Nessus	EulerOS Virtualization for ARM 64 3.0.6.0 : gnutls (EulerOS-SA-2021-1582)	4 Mar 202100:00	–	nessus
Tenable Nessus	Fedora 32 : mingw-gnutls (2020-0ab6656303)	14 Sep 202000:00	–	nessus
Tenable Nessus	FreeBSD : GnuTLS -- NULL pointer dereference (2272e6f1-f029-11ea-838a-0011d823eebd)	8 Sep 202000:00	–	nessus