Description · from the CVE record
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, the gdi_surface_bits() function processes SURFACE_BITS_COMMAND messages sent by the RDP server. When the command is handled using NSCodec, the bmp.width and bmp.height values provided by the server are not properly validated against the actual desktop dimensions. A malicious RDP server can supply crafted bmp.width and bmp.height values that exceed the expected surface size. Because these values are used during bitmap decoding and memory operations without proper bounds checking, this can lead to a heap buffer overflow. Since the attacker can also control the associated pixel data transmitted by the server, the overflow may be exploitable to overwrite adjacent heap memory. This vulnerability is fixed in 3.24.0.
Affected
ProductAffectedFixed inSource
FreeRDP< 3.24.0–CNA
Red Hat Enterprise Linux 10see advisory2:3.10.3-12.el10_2.2redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory2:3.10.3-3.el10_0.5redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory0:2.1.1-5.el7_9.7redhat-SADP
Red Hat Enterprise Linux 8see advisory2:2.11.7-6.el8_10redhat-SADP
Red Hat Enterprise Linux 8.2 Advanced Update Supportsee advisory2:2.0.0-46.rc4.el8_2.10redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory2:2.2.0-12.el8_4redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory2:2.2.0-12.el8_4redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory2:2.2.0-7.el8_6.5redhat-SADP
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory2:2.2.0-7.el8_6.5redhat-SADP
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionssee advisory2:2.2.0-7.el8_6.5redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory2:2.2.0-12.el8_8.5redhat-SADP
Scores by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
redhat-SADP (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total
by Kastro