CVE-2024-22211: FreeRDP integer Overflow leading to Heap Overflow

Q: What is the severity of CVE-2024-22211?

CVE-2024-22211 has a high severity rating due to its potential for causing a heap-buffer overflow in FreeRDP.

Q: How do I fix CVE-2024-22211?

To remediate CVE-2024-22211, update FreeRDP to version 2.11.5 or higher.

Q: Which versions of FreeRDP are affected by CVE-2024-22211?

CVE-2024-22211 affects FreeRDP versions prior to 2.11.5, including versions between 3.0.0 and 3.2.0.

Q: What impact does CVE-2024-22211 have on FreeRDP clients?

CVE-2024-22211 can lead to denial of service or arbitrary code execution in affected FreeRDP client implementations.

Q: Is there a specific distribution that addresses CVE-2024-22211?

Yes, affected users should look for patched packages in distributions like Ubuntu, Debian, and Red Hat that include the fix for CVE-2024-22211.

Published Jan 19, 2024

Updated

FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in freerdpbitmapplanarcontextreset leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a RDPGFXRESETGRAPHICSPDU to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

Affected Software

5 affected componentsFixes available

redhat/freerdp<2.11.5

2.11.5

redhat/freerdp<3.2.0

3.2.0

FreeRDP freerdp<2.11.5

FreeRDP freerdp>=3.0.0<3.2.0

debian/freerdp2<=2.3.0+dfsg1-2+deb11u1, <=2.10.0+dfsg1-1

2.3.0+dfsg1-2+deb11u3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 2.11.5
Upgrade
Upgrade redhat/freerdp to a version that resolves this vulnerability.
Fixed in 3.2.0
Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.3.0+dfsg1-2+deb11u3
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.5
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.2.0

Event History

Jan 19, 2024

CVE Published

via MITRE·07:54 PM

Data Sourced

via MITRE·07:54 PM

DescriptionSeverityWeakness

Apr 24, 2024

Data Sourced

via Launchpad·06:34 PM

Description

Mar 11, 2025

Data Sourced

via Ubuntu·04:35 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Debian·04:36 PM

DescriptionAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-22211?

CVE-2024-22211 has a high severity rating due to its potential for causing a heap-buffer overflow in FreeRDP.

How do I fix CVE-2024-22211?

To remediate CVE-2024-22211, update FreeRDP to version 2.11.5 or higher.

Which versions of FreeRDP are affected by CVE-2024-22211?

CVE-2024-22211 affects FreeRDP versions prior to 2.11.5, including versions between 3.0.0 and 3.2.0.

What impact does CVE-2024-22211 have on FreeRDP clients?

CVE-2024-22211 can lead to denial of service or arbitrary code execution in affected FreeRDP client implementations.

Is there a specific distribution that addresses CVE-2024-22211?

Yes, affected users should look for patched packages in distributions like Ubuntu, Debian, and Red Hat that include the fix for CVE-2024-22211.

CVE-2024-22211: FreeRDP integer Overflow leading to Heap Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2024-22211?

How do I fix CVE-2024-22211?

Which versions of FreeRDP are affected by CVE-2024-22211?

What impact does CVE-2024-22211 have on FreeRDP clients?

Is there a specific distribution that addresses CVE-2024-22211?

Company

Resources

Contact