An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. Upstream Commits: https://github.com/FreeRDP/FreeRDP/commit/8fb6336a4072abcee8ce5bd6ae91104628c7bb69 https://github.com/FreeRDP/FreeRDP/commit/d6cd14059b257318f176c0ba3ee0a348826a9ef8
Created freerdp tracking bugs for this issue: Affects: epel-all [bug 1841197] Created freerdp1.2 tracking bugs for this issue: Affects: fedora-all [bug 1841198]
Looks like this patch adds a NULL-check on the rdp and fips_decrypt pointers... This would protect against a NULL pointer dereference in functions called within winpr_Cipher_Update but not uninitialized pointer, which could be non-NULL.
Technical Summary: The flaw existed because when security_fips_decrypt() in libfreerdp/core/security.c was called, it was possible that rdp->fips_decrypt to be 0-initialized, which would cause an out-of-bounds read when passed to winpr_Cipher_Update(). This may cause a crash or memory information leak. security_fips_decrypt() is called by rdp_decrypt() which is used by the client and server. Upstream notes that since the rdp and rdp->fips_decrypt memory is allocated using calloc()[1], which initializes the memory to 0, the above patch is sufficient to detect "initialized" memory in this case. 1. https://github.com/FreeRDP/FreeRDP/blob/3ba66db99d72e5a4771a44e1032d7060653a131e/libfreerdp/core/freerdp.c#L640
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:4031 https://access.redhat.com/errata/RHSA-2020:4031
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-13397
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4647 https://access.redhat.com/errata/RHSA-2020:4647