In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2. References: http://www.freerdp.com/2020/06/22/2_1_2-released https://github.com/FreeRDP/FreeRDP/commit/b8beb55913471952f92770c90c372139d78c16c0 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mjw7-3mq2-996x
Created freerdp tracking bugs for this issue: Affects: epel-all [bug 1854849] Affects: fedora-all [bug 1854848]
Technical Summary: The static buffers CBR2_BPP[], BPP_BMF[], etc... in libfreerdp/core/orders.c, could potentially be accessed out-of-bounds in various functions, including update_read_cache_bitmap_v3_order(). To remedy this, the patch replaces these static arrays with getter functions that prevent out-of-bounds reads and then modifies the callers to use the getters instead of direct accesses to the static buffers. In the case of update_read_cache_bitmap_v3_order(), an incorrect flags value would then be used to set bitsPerPixelId which would in turn be used to index CBR23_BPP, causing an out-of-bounds read of that array.
Mitigation: Do not enable the +bitmap-cache option in the freerdp client. Alternatively, the bitmap-cache can be explicitly disabled with the -bitmap-cache commandline option.
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1849 https://access.redhat.com/errata/RHSA-2021:1849
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11096