In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. References: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mx9p-f6q8-mqwq https://pub.freerdp.com/cve/CVE-2020-11039/
Created freerdp tracking bugs for this issue: Affects: fedora-all [bug 1848023] Created freerdp1.2 tracking bugs for this issue: Affects: fedora-all [bug 1848024]
Technical Summary: In freerdp, the CLIENT's msusb_msinterface_read() routine of channels/urbdrc/common/msusb.c, a NumberOfPipes UINT32 is read from the input stream. It is then passed to msusb_mspipes_read(), which could lead to an unsigned integer wrap, out of bounds read, arbitrary memory allocation size, and arbitrary memory write of stream data to heap memory. However, exploitation of this would require that a victim connect the freerdp client to an untrusted or compromised server first and be using USB redirection to that server, which needs to be enabled in client config.
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/9f77fc3dd2394373e1be753952b00dafa1a9b7da
Mitigation: To mitigate this flaw, do not enable USB redirection in the client config.
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11039
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647