An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value.
Created freerdp tracking bugs for this issue:
Affects: epel-all [bug 1841197]
Created freerdp1.2 tracking bugs for this issue:
Affects: fedora-all [bug 1841198]
Looks like this patch adds a NULL-check on the rdp and fips_decrypt pointers... This would protect against a NULL pointer dereference in functions called within winpr_Cipher_Update but not uninitialized pointer, which could be non-NULL.
The flaw existed because when security_fips_decrypt() in libfreerdp/core/security.c was called, it was possible that rdp->fips_decrypt to be 0-initialized, which would cause an out-of-bounds read when passed to winpr_Cipher_Update(). This may cause a crash or memory information leak. security_fips_decrypt() is called by rdp_decrypt() which is used by the client and server.
Upstream notes that since the rdp and rdp->fips_decrypt memory is allocated using calloc(), which initializes the memory to 0, the above patch is sufficient to detect "initialized" memory in this case.