CVE-2022-39319: Missing length validation in urbdrc channel in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the urbdrc channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the /usb redirection switch.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39319?
CVE-2022-39319 is a vulnerability in FreeRDP, a remote desktop protocol library and clients, where affected versions are missing input length validation in the urbdrc channel, allowing a malicious server to trick a client into reading out-of-bounds data.
What is the severity of CVE-2022-39319?
CVE-2022-39319 has a severity score of 4.6, categorized as medium severity.
How does CVE-2022-39319 impact FreeRDP?
CVE-2022-39319 impacts FreeRDP by allowing a malicious server to exploit the missing input length validation in the urbdrc channel, potentially causing out-of-bounds data leaks.
How can CVE-2022-39319 be fixed?
CVE-2022-39319 can be fixed by updating to a version of FreeRDP that includes the patch addressing the vulnerability.
Where can I find more information about CVE-2022-39319?
More information about CVE-2022-39319 can be found on the GitHub security advisory page and the Fedora Project announcement.