Bug 1848022 (CVE-2020-11039)

Summary:	CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
Product:	[Other] Security Response	Reporter:	Michael Kaplan <mkaplan>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mads, mailinglists, negativo17, oholy, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	freerdp 2.1.0	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-29 22:01:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1848023, 1848024, 1850783, 1850784
Bug Blocks:	1848044

Description Michael Kaplan 2020-06-17 14:35:44 UTC

In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.

References:

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mx9p-f6q8-mqwq
https://pub.freerdp.com/cve/CVE-2020-11039/

Comment 1 Michael Kaplan 2020-06-17 14:36:19 UTC

Created freerdp tracking bugs for this issue:

Affects: fedora-all [bug 1848023]


Created freerdp1.2 tracking bugs for this issue:

Affects: fedora-all [bug 1848024]

Comment 2 Todd Cullum 2020-06-24 21:09:00 UTC

Technical Summary:

In freerdp, the CLIENT's msusb_msinterface_read() routine of channels/urbdrc/common/msusb.c, a NumberOfPipes UINT32 is read from the input stream. It is then passed to msusb_mspipes_read(), which could lead to an unsigned integer wrap, out of bounds read, arbitrary memory allocation size, and arbitrary memory write of stream data to heap memory. However, exploitation of this would require that a victim connect the freerdp client to an untrusted or compromised server first and be using USB redirection to that server, which needs to be enabled in client config.

Comment 4 Todd Cullum 2020-06-24 21:13:53 UTC

Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/9f77fc3dd2394373e1be753952b00dafa1a9b7da

Comment 6 Todd Cullum 2020-06-24 21:19:06 UTC

Mitigation:

To mitigate this flaw, do not enable USB redirection in the client config.

Comment 7 errata-xmlrpc 2020-09-29 20:44:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031

Comment 8 Product Security DevOps Team 2020-09-29 22:01:50 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11039

Comment 9 errata-xmlrpc 2020-11-04 02:39:18 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647