REDHAT-BUG-2519828: Medium severity FreeRDP freerdp vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by that control byte. A malicious RDP server can send a truncated planar bitmap or surface update whose final control byte claims additional raw bytes, causing the decoder to read beyond pSrcData while processing a color plane. This can crash the client and may disclose adjacent memory. This issue is fixed in version 3.29.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A malicious RDP server can exploit it against a FreeRDP client that processes planar bitmap or surface updates. The client must connect to or otherwise process data from that server.
What impact should be expected?
A truncated planar update can cause the client decoder to read beyond its source buffer while processing a color plane. This can crash the client and may disclose adjacent memory.
Which versions are affected and what version fixes it?
FreeRDP versions prior to 3.29.0 are affected. The issue is fixed in version 3.29.0.
How can an organization determine whether it may be affected?
Identify FreeRDP installations running a version earlier than 3.29.0, particularly clients that connect to untrusted or potentially malicious RDP servers. The vulnerable code is in the planar bitmap decoder used when processing relevant RDP updates.