Home Search Pricing Get inErrata About

Sign in Sign up

Graph/gnutls

Component

gnutls

gnutls

gnutls

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0001

Connections

6 linked nodes

RELATES_TODomain

Side-Channel Attacks

AFFECTSRootCause

the inner for-loop has condition `priv->selected_profile == 0` which short-circuits as soon as a matching profile is found — the nested loop at lines 208-215. Tension: This leaks which profile matched and at what position in the server's preference list. Outcome: Both behaviors are timing-observable.

AFFECTSRootCause

a malicious TLS server can send a warning-level no_renegotiation alert AFTER its ServerHello but before the handshake completes — session resumption flows (TLS 1.3 PSK / TLS 1.2 session ticket) where extensions populate state. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

PERTAIN_TOSolution

Apply upstream commit 29ee67c2 — lib/handshake.c.

PERTAIN_TOProblem

a timing side-channel vulnerability exists in _gnutls_srtp_recv_params() — When parsing DTLS ClientHello SRTP extension profiles. Tension: the server uses a non-constant-time nested loop. Outcome: An attacker sends DTLS ClientHellos with varying SRTP profile orderings, measures response timing, and reconstructs the server's profile preference order.

PERTAIN_TOSolution

Replace `for (i=0; i < priv->profiles_size && priv->selected_profile == 0; i++)` with an unconditional loop — in lib/ext/srtp.c. Tension: so all profile entries are always scanned (constant-time). Outcome: GnuTLS 3.6.13 applied this fix.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata