CVE-2022-41877: Missing input length validation in `drive` channel in FreeRDP

Q: What is CVE-2022-41877?

CVE-2022-41877 is a vulnerability in FreeRDP, a remote desktop protocol library and clients, where affected versions are missing input length validation in the `drive` channel, allowing a malicious server to trick a client into reading out-of-bounds data.

Q: What is the severity of CVE-2022-41877?

The severity of CVE-2022-41877 is medium, with a CVSS score of 4.6.

Q: Which versions of FreeRDP are affected by CVE-2022-41877?

Versions up to and excluding 2.9.0 of FreeRDP are affected by CVE-2022-41877.

Q: How can a malicious server exploit CVE-2022-41877?

A malicious server can exploit CVE-2022-41877 by tricking a FreeRDP client to read out-of-bounds data and send it back to the server.

Q: How can I fix the vulnerability CVE-2022-41877?

To fix the vulnerability CVE-2022-41877, users should update to version 2.9.0 or higher of FreeRDP.

Published Nov 16, 2022

Updated

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in drive channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel - command line options /drive, +drives or +home-drive.

Affected Software

8 affected componentsFixes available

debian/freerdp2<=2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2, <=2.3.0+dfsg1-2+deb11u1

2.3.0+dfsg1-2+deb10u42.10.0+dfsg1-12.11.2+dfsg1-12.11.5+dfsg1-1

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.18.04.4+

2.2.0+dfsg1-0ubuntu0.18.04.4+

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.20.04.6

2.2.0+dfsg1-0ubuntu0.20.04.6

ubuntu/freerdp2<2.6.1+dfsg1-3ubuntu2.5

2.6.1+dfsg1-3ubuntu2.5

ubuntu/freerdp2<2.9.0

2.9.0

FreeRDP freerdp<2.9.0

Fedoraproject Fedora=36

Fedoraproject Fedora=37

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.3.0+dfsg1-2+deb10u4Fixed in 2.10.0+dfsg1-1Fixed in 2.11.2+dfsg1-1Fixed in 2.11.5+dfsg1-1
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.18.04.4+
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.20.04.6
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.6.1+dfsg1-3ubuntu2.5
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.9.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.9.0
Configuration
If you cannot upgrade, do not use the drive redirection channel: do not enable `/drive`, `+drives`, or `+home-drive` on the FreeRDP client command line.
FreeRDP client (drive redirection) drive redirection channel usage (/drive, +drives, +home-drive) = disabled

Event History

Nov 16, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Jan 20, 2024

Data Sourced

via Launchpad·04:02 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2022-41877?

CVE-2022-41877 is a vulnerability in FreeRDP, a remote desktop protocol library and clients, where affected versions are missing input length validation in the `drive` channel, allowing a malicious server to trick a client into reading out-of-bounds data.

What is the severity of CVE-2022-41877?

The severity of CVE-2022-41877 is medium, with a CVSS score of 4.6.

Which versions of FreeRDP are affected by CVE-2022-41877?