AI_ONLY_REPORT
package: gnome-remote-desktop
------
Summary: Heap buffer overflow in TLS peek buffer handling: In
`grd_vnc_tls_read_from_socket()`, leftover bytes from the internal TLS peek
buffer are incorrectly `memmove()`d into the caller-supplied read buffer
`buf` when `len < peek_buffer_len`, causing an out-of-bounds write and
leaving the peek-buffer state inconsistent.
Requirements to exploit: Network reachability to a GNOME Remote Desktop VNC
deployment that exercises the VNC TLS path; attacker must trigger a sequence
where peek buffers more data than a following read consumes
(`peek_buffer_len > 2 * len` for the overflow).
Component affected: `gnome-remote-desktop`, `src/grd-vnc-tls.c`
(`grd_vnc_tls_read_from_socket()`, `grd_vnc_tls_peek_at_socket()`)
Version affected: RHEL/CentOS gnome-remote-desktop package versions
>= 0.1.6-1 through <= 40.0-11 (downstream only)
Patch available: yes
Upstream coordination: Downstream only
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - 6.5
Impact: Moderate
Embargo: no
Acknowledgement: Aisle Research
Vulnerability Details: When `to_read < tls_session->peek_buffer_len`, the
code copies `to_read` bytes into `buf`, then `memmove()`s the remaining
peeked bytes into `buf` again instead of compacting
`tls_session->peek_buffer` and reducing `peek_buffer_len`, producing an
out-of-bounds write and inconsistent pending state.
CWE: CWE-787