CVE-2024-32458: FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

Q: What is the severity of CVE-2024-32458?

CVE-2024-32458 is categorized as a vulnerability that can lead to out-of-bounds read issues, which can potentially allow an attacker to gain unauthorized access or information.

Q: How do I fix CVE-2024-32458?

To fix CVE-2024-32458, update FreeRDP to version 3.5.0 or 2.11.6 or later.

Q: Which versions of FreeRDP are affected by CVE-2024-32458?

FreeRDP versions prior to 3.5.0 and 2.11.6 are affected by CVE-2024-32458.

Q: What operating systems are impacted by CVE-2024-32458?

CVE-2024-32458 affects FreeRDP implementations on Ubuntu, Debian, and Fedora systems that utilize vulnerable versions.

Q: Can I use a workaround for CVE-2024-32458?

As a temporary workaround for CVE-2024-32458, you can use `/gfx` or `/rfx` modes when using FreeRDP.

Published Apr 22, 2024

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use /gfx or /rfx modes (on by default, require server side support).

Affected Software

10 affected componentsFixes available

redhat/freerdp<3.5.0

3.5.0

redhat/freerdp<2.11.6

2.11.6

FreeRDP freerdp<2.11.6

FreeRDP freerdp>=3.0.0<3.5.0

Fedoraproject Fedora=38

Fedoraproject Fedora=39

Fedoraproject Fedora=40

debian/freerdp2<2.11.7+dfsg1-6~deb12u1

2.11.7+dfsg1-6~deb12u1

debian/freerdp2

2.11.7+dfsg1-6~deb12u1

debian/freerdp3

3.15.0+dfsg-2.1+deb13u33.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/FreeRDP to a version that resolves this vulnerability.
Fixed in 3.5.0
Upgrade
Upgrade redhat/FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.6
Upgrade
Upgrade debian/freerdp2 to a version that resolves this vulnerability.
Fixed in 2.11.7+dfsg1-6~deb12u1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.15.0+dfsg-2.1+deb13u3Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.5.0
Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 2.11.6
Configuration
Use /gfx or /rfx modes as a workaround; these modes require server-side support.
FreeRDP-based clients graphics mode = /gfx or /rfx

Event History

Apr 22, 2024

CVE Published

via MITRE·08:52 PM

Data Sourced

via MITRE·08:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·09:15 PM

DescriptionSeverityAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4053-1

Frequently Asked Questions

What is the severity of CVE-2024-32458?

CVE-2024-32458 is categorized as a vulnerability that can lead to out-of-bounds read issues, which can potentially allow an attacker to gain unauthorized access or information.

How do I fix CVE-2024-32458?

To fix CVE-2024-32458, update FreeRDP to version 3.5.0 or 2.11.6 or later.

Which versions of FreeRDP are affected by CVE-2024-32458?

FreeRDP versions prior to 3.5.0 and 2.11.6 are affected by CVE-2024-32458.

What operating systems are impacted by CVE-2024-32458?

CVE-2024-32458 affects FreeRDP implementations on Ubuntu, Debian, and Fedora systems that utilize vulnerable versions.

Can I use a workaround for CVE-2024-32458?

As a temporary workaround for CVE-2024-32458, you can use `/gfx` or `/rfx` modes when using FreeRDP.

CVE-2024-32458: FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

Affected Software

Remediation

Event History

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-32458?

How do I fix CVE-2024-32458?

Which versions of FreeRDP are affected by CVE-2024-32458?

What operating systems are impacted by CVE-2024-32458?

Can I use a workaround for CVE-2024-32458?

Company

Resources

Contact