Bug 1848008 (CVE-2020-11018)

Summary:	CVE-2020-11018 freerdp: Out of bound read in cliprdr_server_receive_capabilities
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mads, mailinglists, negativo17, oholy, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	freerdp 2.1.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 22:01:44 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1848009, 1848010, 1850301, 1850302
Bug Blocks:	1848044

Description Michael Kaplan 2020-06-17 14:22:10 UTC

In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0.

References:

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8cvc-vcw7-6mfw
https://pub.freerdp.com/cve/CVE-2020-11018/

Comment 1 Michael Kaplan 2020-06-17 14:22:38 UTC

Created freerdp tracking bugs for this issue:

Affects: fedora-all [bug 1848009]


Created freerdp1.2 tracking bugs for this issue:

Affects: fedora-all [bug 1848010]

Comment 2 Todd Cullum 2020-06-24 00:53:41 UTC

Technical Summary:

The cliprdr_server_receive_capabilities() routine in channels/cliprdr/server/cliprdr_main.c uses the capabilities.cCapabilitiesSets member to control a for loop which makes calls to realloc(). An attacker could send a crafted payload to the server which could trigger an out-of-bounds read on the input stream and cause the loop to execute an arbitrary number of times, calling realloc() each time. The patch checks the stream buffer first to ensure it will not be read out of bounds. Same patch as CVE-2020-11017: https://github.com/FreeRDP/FreeRDP/commit/8e1a1b407565eb0a48923c796f5b1f69167b3c48#diff-bc0ad095bdf6539472bc4347538bcebe

The realloc() call does not exist in versions of freerdp shipped with Red Hat Enterprise Linux of any version. However, the current implementation shipped with RHEL 7 and 8 could potentially be vulnerable to the out-of-bounds read, just not for the realloc() portion.

Comment 4 errata-xmlrpc 2020-09-29 20:44:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031

Comment 5 Product Security DevOps Team 2020-09-29 22:01:44 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11018

Comment 6 errata-xmlrpc 2020-11-04 02:39:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647