REDHAT-BUG-2519826: High severity FreeRDP freerdp vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context->common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVEFORMATOPUS with a client built with WITHOPUS enabled and WITHDSPFFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPoolTake destination used by channels/rdpsnd/client/rdpsndmain.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP (libfreerdp)to a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
Which FreeRDP clients are exposed to this issue?
Clients using FreeRDP versions prior to 3.28.0 are affected when built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The vulnerable path is used when the client negotiates WAVE_FORMAT_OPUS with an RDP server.
What must an attacker control to exploit it?
An attacker needs to operate or control a malicious RDP server that a vulnerable client connects to. The server must negotiate Opus audio and provide a crafted frame large enough to overflow the client-side 4096-byte destination buffer.
What is the likely impact on an affected client?
A malicious server can corrupt the FreeRDP client heap and crash the client. The issue may also permit code execution on the client.
What should be done if immediate patching is not possible?
Avoid connecting vulnerable FreeRDP clients to untrusted RDP servers, especially where Opus audio may be negotiated. The available fixed version is 3.28.0.