PT-2023-4673 · Freerdp+1 · Freerdp+1

Pwn2Carr · Published 2023-08-09 · Updated 2024-03-28 · CVE-2023-40187

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.0.0-beta3

Description The issue is related to a Use-After-Free problem in the avc420 ensure buffer and avc444 ensure buffer functions of the FreeRDP client. This occurs when the value of piDstSize[x] is 0, causing ppYUVDstData[x] to be freed without being updated, leading to a Use-After-Free vulnerability. Exploitation of this issue could allow a remote attacker to cause a denial of service or other impact.

Recommendations For FreeRDP versions prior to 3.0.0-beta3, upgrade to version 3.0.0-beta3 or later to address the issue. As a temporary workaround, consider restricting the use of the avc420 ensure buffer and avc444 ensure buffer functions until a patch is available. However, it is advised that there are no known workarounds for this vulnerability, and upgrading is the recommended course of action.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-05086

CVE-2023-40187

GHSA-PWF9-V5P9-CH4F

Affected Products

Freerdp

Red Os

References · 16

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pwf9-v5p9-ch4f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40187.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-40187 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05086 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-40187 · Security Note
• https://ubuntu.com/security/CVE-2023-40187 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40187 · Security Note
• https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/h264.c#L413-L427 · Note
• https://twitter.com/VulmonFeeds/status/1697411182028620060 · Twitter Post
• https://security.gentoo.org/glsa/202401-16 · Note
• https://vuldb.com/?id.238513 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-freerdp3-cve-2023-40187-cve-2023-40574-cve-2023-40575 · Note
• https://t.me/cibsecurity/69609 · Telegram Post