In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0. References: https://pub.freerdp.com/cve/CVE-2020-11017/ https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5c8-fm29-q57c
Created freerdp tracking bugs for this issue: Affects: epel-all [bug 1848001] Affects: fedora-all [bug 1848002] Created freerdp1.2 tracking bugs for this issue: Affects: fedora-all [bug 1848003]
Technical Summary: The freerdp server function cliprdr_server_receive_capabilities() reads data bytes out of an input stream that is received from the freerdp client application. One data point that is read by cliprdr_server_receive_capabilities() is the UINT16, capabilitySetLength. capabilitySetLength is used to control the caps_set_size variable, that is subsequently passed in a call to realloc()[1] as the size parameter. A malicious client could cause a call to realloc(capabilities.capabilitySets, 0), which would free the memory pointed to by capabilities.capabilitySets[2]. The code directly after the call to realloc() checks for NULL in order to avoid a potential NULL pointer reference in the case where realloc() were to fail. However, the code attempts to free capabilities.capabilitySets if the return from realloc() is NULL. This is a problem because a call to realloc(capabilities.capabilitySets, 0) will have already freed the memory pointed to by capabilities.capabilitySets and thus trigger a double-free if capabilitySetLength is 0. Exploiting this flaw could crash the freerdp server remotely and lead to a denial of service. The vulnerable functionality is in the clipboard functionality, which can be disabled in the server settings. 1. https://github.com/FreeRDP/FreeRDP/blob/aa07efeb18ac9eb8df3ce8410b116b8c4b080270/channels/cliprdr/server/cliprdr_main.c#L489 2. https://linux.die.net/man/3/realloc
Statement: This flaw does not affect any versions of freerdp as shipped with Red Hat Enterprise Linux. Versions of freerdp shipped with Red Hat Enterprise Linux 6, 7, and 8 do not have the vulnerable code.
Mitigation: Disable clipboard functionality in the freerdp server settings.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11017
Upstream patch: https://github.com/FreeRDP/FreeRDP/commit/8e1a1b407565eb0a48923c796f5b1f69167b3c48#diff-bc0ad095bdf6539472bc4347538bcebe