CVE-2023-40589

31.08.2023, 19:15

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Classic Buffer Overflow

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
GitHub_M	CNA	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 30%

Vendor	Product	Version
freerdp	freerdp	𝑥 < 2.11.0
freerdp	freerdp	3.0.0:beta1
freerdp	freerdp	3.0.0:beta2
debian	debian_linux	10.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freerdp2

bullseye	no-dsa
bookworm	no-dsa
trixie	2.11.7+dfsg1-6 fixed
sid	2.11.7+dfsg1-6 fixed

Ubuntu Releases

Ubuntu Product

Codename

freerdp2

mantic	Fixed 2.10.0+dfsg1-1.1ubuntu1 released
lunar	Fixed 2.10.0+dfsg1-1ubuntu0.2 released
jammy	Fixed 2.6.1+dfsg1-3ubuntu2.4 released
focal	Fixed 2.2.0+dfsg1-0ubuntu0.20.04.5 released
bionic	Fixed 2.2.0+dfsg1-0ubuntu0.18.04.4+esm1 released
xenial	ignored
trusty	ignored

Known Exploits!

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x

https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/