A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLSEAGAIN and GNUTLSEINTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service.

AIONLYREPORT package: gnome-remote-desktop ------ Summary: Heap buffer overflow in TLS peek buffer handling: In grdvnctlsreadfromsocket(), leftover bytes from the internal TLS peek buffer are incorrectly memmove()d into the caller-supplied read buffer buf when len < peekbufferlen, causing an out-of-bounds write and leaving the peek-buffer state inconsistent. Requirements to exploit: Network reachability to a GNOME Remote Desktop VNC deployment that exercises the VNC TLS path; attacker must trigger a sequence where peek buffers more data than a following read consumes (peekbufferlen > 2 len for the overflow). Component affected: gnome-remote-desktop, src/grd-vnc-tls.c (grdvnctlsreadfromsocket(), grdvnctlspeekatsocket()) Version affected: RHEL/CentOS gnome-remote-desktop package versions = 0.1.6-1 through <= 40.0-11 (downstream only) Patch available: yes Upstream coordination: Downstream only CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 Impact: Moderate Embargo: no Acknowledgement: Aisle Research Vulnerability Details: When toread < tlssession->peekbufferlen, the code copies toread bytes into buf, then memmove()s the remaining peeked bytes into buf again instead of compacting tlssession->peekbuffer and reducing peekbufferlen, producing an out-of-bounds write and inconsistent pending state. CWE: CWE-787