CVE-2025-9820: Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function
A flaw was found in the GnuTLS library, specifically in the gnutlspkcs11tokeninit() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.
Other sources
Stack-based buffer overflow vulnerability in the PKCS#11 token initialization function gnutlspkcs11tokeninit() of the GnuTLS library. The flaw is caused by an unsafe memcpy into a fixed-size stack buffer (flabel[32]) without proper bounds checking. If an attacker provides a token label longer than 32 bytes, it leads to out-of-bounds memory writes, causing a crash or, in some environments, potential code execution. Although the vulnerability requires local access or interaction with a malicious PKCS#11 token, it poses a security risk by enabling denial-of-service or possible privilege escalation in applications relying on GnuTLS.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/gnutls28to a version that resolves this vulnerability.Fixed in 3.7.1-5+deb11u10Fixed in 3.7.9-2+deb12u6Fixed in 3.7.9-2+deb12u7Fixed in 3.8.9-3+deb13u3Fixed in 3.8.9-3+deb13u4Fixed in 3.8.13-1 - Upgrade
Upgrade
GnuTLSto a version that resolves this vulnerability.Fixed in 3.8.11Patch CVE-2025-9820 - Compensating control
Restrict local access/interaction with PKCS#11 tokens (and token label injection) to reduce the risk of denial-of-service or possible privilege escalation in applications relying on GnuTLS.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9820?
CVE-2025-9820 has a high severity due to the potential for stack-based buffer overflow vulnerabilities.
How do I fix CVE-2025-9820?
To fix CVE-2025-9820, upgrade GnuTLS to version 3.8.12 or later, where this issue is resolved.
Which versions of GnuTLS are affected by CVE-2025-9820?
GnuTLS versions 3.8.11 and earlier are affected by CVE-2025-9820.
What could be the impact of exploiting CVE-2025-9820?
Exploiting CVE-2025-9820 could allow an attacker to execute arbitrary code or crash the application.
Does CVE-2025-9820 affect PKCS#11 token operations?
Yes, CVE-2025-9820 specifically affects the PKCS#11 token initialization process within the GnuTLS library.