Details: https://nvd.nist.gov/vuln/detail/CVE-2023-40181
Pick the patch that was identified[1] by Debian as the solution. [1]: https://security-tracker.debian.org/tracker/CVE-2023-40181 Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../freerdp/freerdp/CVE-2023-40181.patch | 33 +++++++++++++++++++ .../recipes-support/freerdp/freerdp_2.6.1.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp/CVE-2023-40181.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp/CVE-2023-40181.patch b/meta-oe/recipes-support/freerdp/freerdp/CVE-2023-40181.patch new file mode 100644 index 0000000000..05af44af09 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp/CVE-2023-40181.patch @@ -0,0 +1,33 @@ +From de011238a720cf80a7f96ee0d7a43d85fbc0552f Mon Sep 17 00:00:00 2001 +From: Armin Novak <[email protected]> +Date: Mon, 21 Aug 2023 14:30:11 +0200 +Subject: [PATCH] fix cBitsRemaining calculation + +fixed out of bound read reported by @pwn2carr + +(cherry picked from commit c39c82277a73332e9c1b64db98a34559f424fe20) + +CVE: CVE-2023-40181 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/c23cbdc4a5756bd723223c7139654de7439fdcc0] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + libfreerdp/codec/zgfx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/zgfx.c b/libfreerdp/codec/zgfx.c +index 04ddeadb2..4489b3798 100644 +--- a/libfreerdp/codec/zgfx.c ++++ b/libfreerdp/codec/zgfx.c +@@ -259,7 +259,11 @@ static BOOL zgfx_decompress_segment(ZGFX_CONTEXT* zgfx, wStream* stream, size_t + zgfx->pbInputCurrent = pbSegment; + zgfx->pbInputEnd = &pbSegment[cbSegment - 1]; + /* NumberOfBitsToDecode = ((NumberOfBytesToDecode - 1) * 8) - ValueOfLastByte */ +- zgfx->cBitsRemaining = 8 * (cbSegment - 1) - *zgfx->pbInputEnd; ++ const UINT32 bits = 8u * (cbSegment - 1u); ++ if (bits < *zgfx->pbInputEnd) ++ return FALSE; ++ ++ zgfx->cBitsRemaining = bits - *zgfx->pbInputEnd; + zgfx->cBitsCurrent = 0; + zgfx->BitsCurrent = 0; + diff --git a/meta-oe/recipes-support/freerdp/freerdp_2.6.1.bb b/meta-oe/recipes-support/freerdp/freerdp_2.6.1.bb index dd944e450d..b909f88310 100644 --- a/meta-oe/recipes-support/freerdp/freerdp_2.6.1.bb +++ b/meta-oe/recipes-support/freerdp/freerdp_2.6.1.bb @@ -25,6 +25,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;branch=stable-2.0;protocol=https file://CVE-2023-39351.patch \ file://CVE-2023-39352.patch \ file://CVE-2023-39353.patch \ + file://CVE-2023-40181.patch \ " S = "${WORKDIR}/git"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#123687): https://lists.openembedded.org/g/openembedded-devel/message/123687 Mute This Topic: https://lists.openembedded.org/mt/117378240/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
