Bug 1848022 (CVE-2020-11039) - CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
Summary: CVE-2020-11039 freerdp: Out of bound read/write in usb redirection channel
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-11039
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1848023 1848024 1850783 1850784
Blocks: 1848044
TreeView+ depends on / blocked
 
Reported: 2020-06-17 14:35 UTC by Michael Kaplan
Modified: 2021-02-16 19:51 UTC (History)
5 users (show)

Fixed In Version: freerdp 2.1.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-09-29 22:01:50 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4031 0 None None None 2020-09-29 20:44:24 UTC
Red Hat Product Errata RHSA-2020:4647 0 None None None 2020-11-04 02:39:20 UTC

Description Michael Kaplan 2020-06-17 14:35:44 UTC
In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0.

References:

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mx9p-f6q8-mqwq
https://pub.freerdp.com/cve/CVE-2020-11039/

Comment 1 Michael Kaplan 2020-06-17 14:36:19 UTC
Created freerdp tracking bugs for this issue:

Affects: fedora-all [bug 1848023]


Created freerdp1.2 tracking bugs for this issue:

Affects: fedora-all [bug 1848024]

Comment 2 Todd Cullum 2020-06-24 21:09:00 UTC
Technical Summary:

In freerdp, the CLIENT's msusb_msinterface_read() routine of channels/urbdrc/common/msusb.c, a NumberOfPipes UINT32 is read from the input stream. It is then passed to msusb_mspipes_read(), which could lead to an unsigned integer wrap, out of bounds read, arbitrary memory allocation size, and arbitrary memory write of stream data to heap memory. However, exploitation of this would require that a victim connect the freerdp client to an untrusted or compromised server first and be using USB redirection to that server, which needs to be enabled in client config.

Comment 6 Todd Cullum 2020-06-24 21:19:06 UTC
Mitigation:

To mitigate this flaw, do not enable USB redirection in the client config.

Comment 7 errata-xmlrpc 2020-09-29 20:44:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031

Comment 8 Product Security DevOps Team 2020-09-29 22:01:50 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11039

Comment 9 errata-xmlrpc 2020-11-04 02:39:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647


Note You need to log in before you can comment on or make changes to this bug.