PT-2024-1280 · Freerdp+9 · Freerdp+9
Hareh4Ru
·
Published
2024-01-08
·
Updated
2026-03-10
·
CVE-2024-22211
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 2.11.5
FreeRDP versions prior to 3.2.0
Description
The issue is related to an integer overflow in the
freerdp bitmap planar context reset function, leading to a heap-buffer overflow. This affects FreeRDP based clients, while FreeRDP based server implementations and proxy are not affected. A malicious server could prepare a RDPGFX RESET GRAPHICS PDU to allocate too small buffers, possibly triggering later out of bound read/write. The buffers are used to display an image, and data extraction over the network is not possible.Recommendations
For versions prior to 2.11.5, upgrade to version 2.11.5 or later.
For versions prior to 3.2.0, upgrade to version 3.2.0 or later.
As a temporary workaround, consider restricting access to the
RDPGFX RESET GRAPHICS PDU endpoint until a patch is available.
Avoid using the freerdp bitmap planar context reset function until the issue is resolved.Exploit
Fix
DoS
Integer Overflow
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Freerdp
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu