Bug 1854889 (CVE-2020-4031)

Summary:	CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mads, negativo17, oholy, pahan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-07-10 07:27:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1854890, 1854891
Bug Blocks:	1854906

Description Dhananjay Arunesh 2020-07-08 12:17:00 UTC

In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

References:
http://www.freerdp.com/2020/06/22/2_1_2-released
https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g

Comment 1 Dhananjay Arunesh 2020-07-08 12:19:40 UTC

Created freerdp tracking bugs for this issue:

Affects: epel-all [bug 1854891]
Affects: fedora-all [bug 1854890]

Comment 2 Todd Cullum 2020-07-10 03:58:31 UTC

Going off of the code in the linked commit, there's a double-free possible in server/shadow/shadow_server.c's shadow_server_start() routine which, according to the upstream advisory, affects freerdp clients run with the commandline option /relax-order-checks. However, this does not affect any versions of freerdp shipped with Red Hat Enterprise Linux as the vulnerable code is not included in the version shipped with RHEL 6, and versions shipped with 7 and 8 have:

# Disable server support in RHEL
# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
%{!?rhel:%global _with_server 1}

in the specfile, which prevents the shadow-server from being built/installed.

Comment 4 Todd Cullum 2020-07-10 04:05:47 UTC

Statement:

Although the vulnerable code could have been in versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, the build configuration disables the shadow-server functionality and thus the vulnerable code is not shipped. Therefore, versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8 are not affected. The version of freerdp shipped with Red Hat Enterprise Linux 6 does not contain the vulnerable code in the first place.

Comment 5 Product Security DevOps Team 2020-07-10 07:27:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-4031