CVE-2023-40181: Integer-Underflow leading to Out-Of-Bound Read in FreeRDP

Q: What is CVE-2023-40181?

CVE-2023-40181 is a vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP), that allows an integer underflow leading to an out-of-bound read in the `zgfx_decompress_segment` function.

Q: What is the severity of CVE-2023-40181?

The severity of CVE-2023-40181 is critical with a CVSS score of 9.1.

Q: How does CVE-2023-40181 affect FreeRDP?

CVE-2023-40181 affects FreeRDP versions up to and including 2.11.0, 3.0.0-beta1, and 3.0.0-beta2.

Q: How can I fix CVE-2023-40181 in FreeRDP?

To fix CVE-2023-40181 in FreeRDP, you should update to version 2.11.2 or later.

Q: Where can I find more information about CVE-2023-40181?

You can find more information about CVE-2023-40181 on the FreeRDP GitHub repository and the FreeRDP security advisories page.

Published Aug 31, 2023

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the zgfxdecompresssegment function. In the context of CopyMemory, it's possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Affected Software

16 affected componentsFixes available

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.18.04.4+

2.2.0+dfsg1-0ubuntu0.18.04.4+

ubuntu/freerdp2<2.2.0+dfsg1-0ubuntu0.20.04.5

2.2.0+dfsg1-0ubuntu0.20.04.5

ubuntu/freerdp2<2.6.1+dfsg1-3ubuntu2.4

2.6.1+dfsg1-3ubuntu2.4

ubuntu/freerdp2<2.10.0+dfsg1-1ubuntu0.2

2.10.0+dfsg1-1ubuntu0.2

ubuntu/freerdp2<2.10.0+dfsg1-1.1ubuntu1

2.10.0+dfsg1-1.1ubuntu1

ubuntu/freerdp2<2.11.0

2.11.0

redhat/freerdp<2.11.0

2.11.0

redhat/freerdp<3.0.0

3.0.0

debian/freerdp2<=2.3.0+dfsg1-2+deb11u1, <=2.10.0+dfsg1-1

2.11.5+dfsg1-12.11.7+dfsg1-2

FreeRDP freerdp<2.11.0

FreeRDP freerdp=3.0.0-beta1

FreeRDP freerdp=3.0.0-beta2

Debian Debian Linux=10.0

Fedoraproject Fedora=37

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.18.04.4+
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.2.0+dfsg1-0ubuntu0.20.04.5
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.6.1+dfsg1-3ubuntu2.4
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1ubuntu0.2
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.10.0+dfsg1-1.1ubuntu1
Upgrade
Upgrade ubuntu/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 3.0.0
Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.5+dfsg1-1Fixed in 2.11.7+dfsg1-2
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.0.0-beta3

Event History

Aug 31, 2023

CVE Published

via Ubuntu·12:00 AM

CVE Published

via MITRE·09:06 PM

Data Sourced

via MITRE·09:06 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-6401-1

Frequently Asked Questions

What is CVE-2023-40181?

CVE-2023-40181 is a vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP), that allows an integer underflow leading to an out-of-bound read in the `zgfx_decompress_segment` function.

What is the severity of CVE-2023-40181?