Bug 1854889 (CVE-2020-4031) - CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
Summary: CVE-2020-4031 freerdp: use-after-free in gdi_SelectObject
Alias: CVE-2020-4031
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1854890 1854891
Blocks: 1854906
TreeView+ depends on / blocked
Reported: 2020-07-08 12:17 UTC by Dhananjay Arunesh
Modified: 2021-02-16 19:42 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-07-10 07:27:40 UTC

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-07-08 12:17:00 UTC
In FreeRDP before version 2.1.2, there is a use-after-free in gdi_SelectObject. All FreeRDP clients using compatibility mode with /relax-order-checks are affected. This is fixed in version 2.1.2.


Comment 1 Dhananjay Arunesh 2020-07-08 12:19:40 UTC
Created freerdp tracking bugs for this issue:

Affects: epel-all [bug 1854891]
Affects: fedora-all [bug 1854890]

Comment 2 Todd Cullum 2020-07-10 03:58:31 UTC
Going off of the code in the linked commit, there's a double-free possible in server/shadow/shadow_server.c's shadow_server_start() routine which, according to the upstream advisory, affects freerdp clients run with the commandline option /relax-order-checks. However, this does not affect any versions of freerdp shipped with Red Hat Enterprise Linux as the vulnerable code is not included in the version shipped with RHEL 6, and versions shipped with 7 and 8 have:

# Disable server support in RHEL
# https://bugzilla.redhat.com/show_bug.cgi?id=1639165
%{!?rhel:%global _with_server 1}

in the specfile, which prevents the shadow-server from being built/installed.

Comment 4 Todd Cullum 2020-07-10 04:05:47 UTC

Although the vulnerable code could have been in versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8, the build configuration disables the shadow-server functionality and thus the vulnerable code is not shipped. Therefore, versions of freerdp shipped with Red Hat Enterprise Linux 7 and 8 are not affected. The version of freerdp shipped with Red Hat Enterprise Linux 6 does not contain the vulnerable code in the first place.

Comment 5 Product Security DevOps Team 2020-07-10 07:27:40 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):


Note You need to log in before you can comment on or make changes to this bug.