In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. References: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8cvc-vcw7-6mfw https://pub.freerdp.com/cve/CVE-2020-11018/
Created freerdp tracking bugs for this issue: Affects: fedora-all [bug 1848009] Created freerdp1.2 tracking bugs for this issue: Affects: fedora-all [bug 1848010]
Technical Summary: The cliprdr_server_receive_capabilities() routine in channels/cliprdr/server/cliprdr_main.c uses the capabilities.cCapabilitiesSets member to control a for loop which makes calls to realloc(). An attacker could send a crafted payload to the server which could trigger an out-of-bounds read on the input stream and cause the loop to execute an arbitrary number of times, calling realloc() each time. The patch checks the stream buffer first to ensure it will not be read out of bounds. Same patch as CVE-2020-11017: https://github.com/FreeRDP/FreeRDP/commit/8e1a1b407565eb0a48923c796f5b1f69167b3c48#diff-bc0ad095bdf6539472bc4347538bcebe The realloc() call does not exist in versions of freerdp shipped with Red Hat Enterprise Linux of any version. However, the current implementation shipped with RHEL 7 and 8 could potentially be vulnerable to the out-of-bounds read, just not for the realloc() portion.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11018
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647