PT-2023-4664 · Freerdp+8 · Freerdp+8

Pwn2Carr · Published 2023-08-09 · Updated 2025-02-15 · CVE-2023-40181

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.11.0 FreeRDP versions prior to 3.0.0-beta3

Description The issue is related to an Integer-Underflow leading to Out-Of-Bound Read in the zgfx decompress segment function. In the context of CopyMemory, it's possible to read data beyond the transmitted packet range and likely cause a crash. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For FreeRDP versions prior to 2.11.0, upgrade to version 2.11.0 or later. For FreeRDP versions prior to 3.0.0-beta3, upgrade to version 3.0.0-beta3 or later. As a temporary workaround, consider restricting the use of the zgfx decompress segment function until a patch is available. Avoid using the CopyMemory function in the context of the zgfx decompress segment function until the issue is resolved.

Exploit

Fix

Integer Underflow

Out of bounds Read

Weakness Enumeration

CWE-191

CWE-125

Related Identifiers

ALSA-2024:2208

ALT-PU-2023-5489

ALT-PU-2023-5490

ALT-PU-2023-6067

BDU:2023-05077

CVE-2023-40181

DLA-3606-1

DLA-4053-1

GHSA-MXP4-RX7X-H2G8

INFSA-2024_2208

MGASA-2023-0318

OESA-2023-1656

OPENSUSE-SU-2023_4893-1

OPENSUSE-SU-2024:13504-1

RHSA-2024:2208

RHSA-2024_2208

SUSE-SU-2023:4611-1

SUSE-SU-2023:4893-1

USN-6401-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Debian

Freerdp

Linuxmint

Red Hat

Suse

Ubuntu

References · 124

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40181.json · Exploit
• https://ubuntu.com/security/CVE-2023-39351 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2024-2208.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40569 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40567 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-2208.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-40181 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40569 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40188 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40181 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-39351 · Security Note
• https://ubuntu.com/security/notices/USN-6401-1 · Vendor Advisory