FreeRDP up to 3.0.0-beta2 avc420_ensure_buffer/avc444_ensure_buffer use after free
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 8.0 | $0-$5k | 0.00 |
Summary
A vulnerability identified as critical has been detected in FreeRDP up to 3.0.0-beta2. Affected by this vulnerability is the function avc420_ensure_buffer/avc444_ensure_buffer. This manipulation causes use after free.
This vulnerability appears as CVE-2023-40187. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
Details
A vulnerability has been found in FreeRDP up to 3.0.0-beta2 and classified as critical. Affected by this vulnerability is the function avc420_ensure_buffer/avc444_ensure_buffer. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0, `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability.
The weakness was presented 09/01/2023 as GHSA-pwf9-v5p9-ch4f. The advisory is shared at github.com. This vulnerability is known as CVE-2023-40187 since 08/09/2023. Technical details are known, but no exploit is available.
Upgrading to version 3.0.0-beta3 eliminates this vulnerability.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Name
Version
License
Website
- Product: https://github.com/FreeRDP/FreeRDP/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.1VulDB Meta Temp Score: 8.0
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔍
CNA Base Score: 7.3
CNA Vector (GitHub, Inc.): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: Use after freeCWE: CWE-416 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: FreeRDP 3.0.0-beta3
Timeline
08/09/2023 🔍09/01/2023 🔍
09/01/2023 🔍
09/29/2023 🔍
Sources
Product: github.comAdvisory: GHSA-pwf9-v5p9-ch4f
Status: Confirmed
CVE: CVE-2023-40187 (🔍)
GCVE (CVE): GCVE-0-2023-40187
GCVE (VulDB): GCVE-100-238513
Entry
Created: 09/01/2023 07:36Updated: 09/29/2023 07:18
Changes: 09/01/2023 07:36 (49), 09/29/2023 07:18 (11)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.