CVE-2023-39352: Invalid offset validation leading to Out Of Bound Write in FreeRDP

Q: What is CVE-2023-39352?

CVE-2023-39352 is a vulnerability in the FreeRDP software that allows for an out-of-bounds write due to an invalid offset validation.

Q: How severe is CVE-2023-39352?

CVE-2023-39352 has a severity level of 9.8 (Critical).

Q: Which versions of FreeRDP are affected by CVE-2023-39352?

Versions up to and inclusive of 2.11.0, 3.0.0-beta1, and 3.0.0-beta2 of FreeRDP are affected by CVE-2023-39352.

Q: How can CVE-2023-39352 be exploited?

CVE-2023-39352 can be exploited by triggering an out-of-bounds write when specific values are equal.

Q: Is there a fix available for CVE-2023-39352?

Yes, a fix is available for CVE-2023-39352. Users should update to a version of FreeRDP that has the patch applied.

Published Aug 31, 2023

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values rect->left and rect->top are exactly equal to surface->width and surface->height. eg. rect->left == surface->width && rect->top == surface->height. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Software

16 affected componentsFixes available

debian/freerdp2<=2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2, <=2.3.0+dfsg1-2+deb11u1, <=2.10.0+dfsg1-1

2.3.0+dfsg1-2+deb10u42.11.2+dfsg1-12.11.5+dfsg1-1

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.18.04.4+

2.2.0+dfsg1-0ubuntu0.18.04.4+

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.20.04.6

2.2.0+dfsg1-0ubuntu0.20.04.6

ubuntu/freerdp2<2.6.1+dfsg1-3ubuntu2.5

2.6.1+dfsg1-3ubuntu2.5

ubuntu/freerdp2<2.10.0+dfsg1-1ubuntu0.3

2.10.0+dfsg1-1ubuntu0.3

ubuntu/freerdp2<2.10.0+dfsg1-1.1ubuntu1.1

2.10.0+dfsg1-1.1ubuntu1.1

ubuntu/freerdp2<2.11.0, <3.0.0-

2.11.03.0.0-

redhat/freerdp<2.11.0

2.11.0

redhat/freerdp<3.0.0

3.0.0

FreeRDP freerdp<2.11.0

FreeRDP freerdp=3.0.0-beta1

FreeRDP freerdp=3.0.0-beta2

Debian Debian Linux=10.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.3.0+dfsg1-2+deb10u4Fixed in 2.11.2+dfsg1-1Fixed in 2.11.5+dfsg1-1
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.18.04.4+
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.20.04.6
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.6.1+dfsg1-3ubuntu2.5
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1ubuntu0.3
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1.1ubuntu1.1
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.0Fixed in 3.0.0-
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.0

Event History

Aug 31, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·08:46 PM

Data Sourced

via MITRE·08:46 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2023-39352?

CVE-2023-39352 is a vulnerability in the FreeRDP software that allows for an out-of-bounds write due to an invalid offset validation.

How severe is CVE-2023-39352?