CVE-2025-32990
📋 TL;DR
This CVE describes a heap-buffer-overflow vulnerability in GnuTLS's certtool utility when parsing template files. An attacker can trigger memory corruption leading to denial-of-service (system crash). Systems using certtool with untrusted template files are affected.
💻 Affected Systems
- GnuTLS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or potential remote code execution if memory corruption can be weaponized beyond DoS.
Likely Case
Denial-of-service through application crash when processing malicious template files.
If Mitigated
Limited to DoS impact with proper access controls and input validation.
🎯 Exploit Status
Exploitation requires access to run certtool with a malicious template file; no public exploit code known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check specific Red Hat advisories (RHSA-2025:16115, etc.) for patched versions.
Vendor Advisory: https://access.redhat.com/errata/RHSA-2025:16115
Restart Required: No
Instructions:
1. Update GnuTLS package using your distribution's package manager. 2. For Red Hat systems: 'yum update gnutls' or 'dnf update gnutls'. 3. Verify update with version check.
🔧 Temporary Workarounds
Restrict certtool access
linuxLimit who can execute certtool and control template file sources.
chmod 750 /usr/bin/certtool
setfacl -m u:user:rx /usr/bin/certtool
Validate template files
allOnly use trusted, validated template files with certtool.
🧯 If You Can't Patch
- Disable or remove certtool if not required.
- Implement strict access controls and audit certtool usage.
🔍 How to Verify
Check if Vulnerable:
Check GnuTLS version against patched versions in Red Hat advisories.Check Version:
certtool --versionVerify Fix Applied:
Confirm GnuTLS version is updated to patched release.📡 Detection & Monitoring
Log Indicators:
- Unexpected certtool crashes
- Memory error logs in system logs
SIEM Query:
source="system" AND ("certtool" AND ("segmentation fault" OR "memory corruption"))🔗 References
- https://access.redhat.com/errata/RHSA-2025:16115
- https://access.redhat.com/errata/RHSA-2025:16116
- https://access.redhat.com/errata/RHSA-2025:17181
- https://access.redhat.com/errata/RHSA-2025:17348
- https://access.redhat.com/errata/RHSA-2025:17361
- https://access.redhat.com/errata/RHSA-2025:17415
- https://access.redhat.com/errata/RHSA-2025:19088
- https://access.redhat.com/errata/RHSA-2025:22529
- https://access.redhat.com/security/cve/CVE-2025-32990
- https://bugzilla.redhat.com/show_bug.cgi?id=2359620
- http://www.openwall.com/lists/oss-security/2025/07/11/3
- https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html
