REDHAT-BUG-2550367: Buffer Overflow

AIONLYREPORT package: gnome-remote-desktop ------ Summary: Heap buffer overflow in TLS peek buffer handling: In grdvnctlsreadfromsocket(), leftover bytes from the internal TLS peek buffer are incorrectly memmove()d into the caller-supplied read buffer buf when len < peekbufferlen, causing an out-of-bounds write and leaving the peek-buffer state inconsistent. Requirements to exploit: Network reachability to a GNOME Remote Desktop VNC deployment that exercises the VNC TLS path; attacker must trigger a sequence where peek buffers more data than a following read consumes (peekbufferlen > 2 len for the overflow). Component affected: gnome-remote-desktop, src/grd-vnc-tls.c (grdvnctlsreadfromsocket(), grdvnctlspeekatsocket()) Version affected: RHEL/CentOS gnome-remote-desktop package versions = 0.1.6-1 through <= 40.0-11 (downstream only) Patch available: yes Upstream coordination: Downstream only CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 Impact: Moderate Embargo: no Acknowledgement: Aisle Research Vulnerability Details: When toread < tlssession->peekbufferlen, the code copies toread bytes into buf, then memmove()s the remaining peeked bytes into buf again instead of compacting tlssession->peekbuffer and reducing peekbufferlen, producing an out-of-bounds write and inconsistent pending state. CWE: CWE-787