In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2. References: http://www.freerdp.com/2020/06/22/2_1_2-released https://github.com/FreeRDP/FreeRDP/commit/6d86e20e1e7caaab4f0c7f89e36d32914dbccc52 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gwcq-hpq2-m74g
Created freerdp tracking bugs for this issue: Affects: epel-all [bug 1854891] Affects: fedora-all [bug 1854890]
Going off of the code in the linked commit, there's a double-free possible in server/shadow/shadow_server.c's shadow_server_start() routine which, according to the upstream advisory, affects freerdp clients run with the commandline option /relax-order-checks. However, this does not affect any versions of freerdp shipped with Red Hat Enterprise Linux as the vulnerable code is not included in the version shipped with RHEL 6, and versions shipped with 7 and 8 have: # Disable server support in RHEL # https://bugzilla.redhat.com/show_bug.cgi?id=1639165 %{!?rhel:%global _with_server 1} in the specfile, which prevents the shadow-server from being built/installed.
Statement: Although the vulnerable code could have been in versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, the build configuration disables the shadow-server functionality and thus the vulnerable code is not shipped. Therefore, versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8 are not affected. The version of freerdp shipped with Red Hat Enterprise Linux 6 does not contain the vulnerable code in the first place.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-4031