REDHAT-BUG-2483467: Use After Free
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's RDPEAR NDR parser accepts one non-null NDR pointer ref-id for multiple logical pointer fields without tracking the pointed object's expected NDR type or ownership. When the same ref-id is reused across two pointer fields, the parser assigns the same heap object to both output fields. The generic destructor later walks each field independently and destroys/frees both pointers. This causes a malicious-server-triggerable heap use-after-free / double-free in the FreeRDP client's RDPEAR authentication-redirection path. This vulnerability is fixed in 3.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.26.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2483467?
The severity of REDHAT-BUG-2483467 is high with a CVSS score of 7.
What is the risk associated with REDHAT-BUG-2483467?
The risk associated with REDHAT-BUG-2483467 is rated at 33.
How do I fix REDHAT-BUG-2483467?
To fix REDHAT-BUG-2483467, upgrade FreeRDP to version 3.26.0 or later.
What is the main vulnerability described in REDHAT-BUG-2483467?
REDHAT-BUG-2483467 describes a use-after-free vulnerability in the FreeRDP RDPEAR NDR parser.
Which software is affected by REDHAT-BUG-2483467?
The affected software by REDHAT-BUG-2483467 is FreeRDP.