CVE-2023-39355: FreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICS
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x release branch before beta3 are subject to a Use-After-Free in processing RDPGFXCMDIDRESETGRAPHICS packets. If context->maxPlaneSize is 0, context->planesBuffer will be freed. However, without updating context->planesBuffer, this leads to a Use-After-Free exploit vector. In most environments this should only result in a crash. This issue has been addressed in version 3.0.0-beta3 and users of the beta 3.x releases are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-39355?
CVE-2023-39355 is a vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), that allows for a Use-After-Free in processing RDPGFX_CMDID_RESETGRAPHICS packets.
How severe is CVE-2023-39355?
CVE-2023-39355 is considered critical with a severity score of 9.8 out of 10.
What software versions are affected by CVE-2023-39355?
Versions of FreeRDP on the 3.x release branch before beta3, such as 3.0.0-beta1 and 3.0.0-beta2, are affected by CVE-2023-39355.
How can I fix CVE-2023-39355?
To fix CVE-2023-39355, update FreeRDP to version 3.0.0-beta3 or later.
Where can I find more information about CVE-2023-39355?
You can find more information about CVE-2023-39355 in the references provided: [GitHub commit](https://github.com/FreeRDP/FreeRDP/commit/d6f9d33a7db0b346195b6a15b5b99944ba41beee), [GitHub advisory](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hvwj-vmg6-2f5h), [Debian LTS announcement](https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html).