CVE-2020-11038

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.

Weakness

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Affected Software

Name	Vendor	Start Version	End Version
Freerdp	Freerdp	*	2.1.0 (excluding)
Red Hat Enterprise Linux 7	RedHat	freerdp-0:2.1.1-2.el7	*
Red Hat Enterprise Linux 8	RedHat	freerdp-2:2.1.1-1.el8	*
Red Hat Enterprise Linux 8	RedHat	vinagre-0:3.22.0-23.el8	*
Freerdp	Ubuntu	trusty	*
Freerdp2	Ubuntu	bionic	*
Freerdp2	Ubuntu	eoan	*
Freerdp2	Ubuntu	esm-infra/bionic	*
Freerdp2	Ubuntu	esm-infra/focal	*
Freerdp2	Ubuntu	focal	*
Freerdp2	Ubuntu	trusty	*
Freerdp2	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-11038
CWE	https://cwe.mitre.org/data/definitions/680.html

Integer Overflow to Buffer Overflow

Weakness

Affected Software

Related Attack Patterns

References