Bug 2550367 (CVE-2026-109833)
| Summary: | CVE-2026-109833 gnome-remote-desktop: Heap buffer overflow in gnome-remote-desktop VNC TLS peek buffer handling allows remote denial of service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
AI_ONLY_REPORT package: gnome-remote-desktop ------ Summary: Heap buffer overflow in TLS peek buffer handling: In `grd_vnc_tls_read_from_socket()`, leftover bytes from the internal TLS peek buffer are incorrectly `memmove()`d into the caller-supplied read buffer `buf` when `len < peek_buffer_len`, causing an out-of-bounds write and leaving the peek-buffer state inconsistent. Requirements to exploit: Network reachability to a GNOME Remote Desktop VNC deployment that exercises the VNC TLS path; attacker must trigger a sequence where peek buffers more data than a following read consumes (`peek_buffer_len > 2 * len` for the overflow). Component affected: `gnome-remote-desktop`, `src/grd-vnc-tls.c` (`grd_vnc_tls_read_from_socket()`, `grd_vnc_tls_peek_at_socket()`) Version affected: RHEL/CentOS gnome-remote-desktop package versions >= 0.1.6-1 through <= 40.0-11 (downstream only) Patch available: yes Upstream coordination: Downstream only CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5 Impact: Moderate Embargo: no Acknowledgement: Aisle Research Vulnerability Details: When `to_read < tls_session->peek_buffer_len`, the code copies `to_read` bytes into `buf`, then `memmove()`s the remaining peeked bytes into `buf` again instead of compacting `tls_session->peek_buffer` and reducing `peek_buffer_len`, producing an out-of-bounds write and inconsistent pending state. CWE: CWE-787