FreeRDP up to 2.11.4/3.1.x planar.c freerdp_bitmap_planar_context_reset heap-based overflow

Summaryinfo

A vulnerability classified as critical was found in FreeRDP up to 2.11.4/3.1.x. The affected element is the function freerdp_bitmap_planar_context_reset of the file libfreerdp/codec/planar.c. The manipulation results in heap-based overflow. This vulnerability is cataloged as CVE-2024-22211. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in FreeRDP up to 2.11.4/3.1.x. It has been classified as critical. Affected is the function freerdp_bitmap_planar_context_reset of the file libfreerdp/codec/planar.c. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a `RDPGFX_RESET_GRAPHICS_PDU` to allocate too small buffers, possibly triggering later out of bound read/write. Data extraction over network is not possible, the buffers are used to display an image. This issue has been addressed in version 2.11.5 and 3.2.0. Users are advised to upgrade. there are no know workarounds for this vulnerability.

The weakness was shared 01/20/2024 as GHSA-rjhp-44rv-7v59. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-22211 since 01/08/2024. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 216351 (Debian dla-4053 : freerdp2-dev - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.11.5 or 3.2.0 eliminates this vulnerability. Applying the patch 939e922936e9c3ae8fc204968645e5e7563a2fff is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (216351). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 2.11.0
• 2.11.1
• 2.11.2
• 2.11.3
• 2.11.4
• 3.0
• 3.1

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion