Bug 1854889 (CVE-2020-4031) - CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
Summary: CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-4031
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1854890 1854891
Blocks: 1854906
TreeView+ depends on / blocked
 
Reported: 2020-07-08 12:17 UTC by Dhananjay Arunesh
Modified: 2021-02-16 19:42 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2020-07-10 07:27:40 UTC
Embargoed:


Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-07-08 12:17:00 UTC
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.

References:
http://www.freerdp.com/2020/06/22/2_1_2-released
https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g

Comment 1 Dhananjay Arunesh 2020-07-08 12:19:40 UTC
Created freerdp tracking bugs for this issue:

Affects: epel-all [bug 1854891]
Affects: fedora-all [bug 1854890]

Comment 2 Todd Cullum 2020-07-10 03:58:31 UTC
Going off of the code in the linked commit, there's a double-free possible in server/shadow/shadow_server.c's shadow_server_start() routine which, according to the upstream advisory, affects freerdp clients run with the commandline option /relax-order-checks. However, this does not affect any versions of freerdp shipped with Red Hat Enterprise Linux as the vulnerable code is not included in the version shipped with RHEL 6, and versions shipped with 7 and 8 have:

# Disable server support in RHEL
# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
%{!?rhel:%global _with_server 1}

in the specfile, which prevents the shadow-server from being built/installed.

Comment 4 Todd Cullum 2020-07-10 04:05:47 UTC
Statement:

Although the vulnerable code could have been in versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, the build configuration disables the shadow-server functionality and thus the vulnerable code is not shipped. Therefore, versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8 are not affected. The version of freerdp shipped with Red Hat Enterprise Linux 6 does not contain the vulnerable code in the first place.

Comment 5 Product Security DevOps Team 2020-07-10 07:27:40 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-4031


Note You need to log in before you can comment on or make changes to this bug.