From 20944102c309af90dbc75226fd5dfe31704672ab Mon Sep 17 00:00:00 2001 From: Marek Kasik Date: Mon, 16 Jun 2025 10:55:42 +0200 Subject: [PATCH] Initialize function pointers after resource allocation Fixes CVE-2025-4478 Resolves: RHEL-91583 --- ...n-pointers-after-resource-allocation.patch | 64 +++++++++++++++++++ freerdp.spec | 10 ++- 2 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 Initialize-function-pointers-after-resource-allocation.patch diff --git a/Initialize-function-pointers-after-resource-allocation.patch b/Initialize-function-pointers-after-resource-allocation.patch new file mode 100644 index 0000000..ecda3b8 --- /dev/null +++ b/Initialize-function-pointers-after-resource-allocation.patch @@ -0,0 +1,64 @@ +From a4bb702aa62e4fad91ca99142de075265555ec18 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jonas=20=C3=85dahl?= +Date: Tue, 13 May 2025 10:34:08 +0200 +Subject: [PATCH] transport: Initialize function pointers after resource + allocation + +The transport instance is freed when an error occurs. +If the TransportDisconnect function pointer is initialized it +causes SIGSEGV during free. + +CVE: CVE-2025-4478 +--- + libfreerdp/core/transport.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/libfreerdp/core/transport.c b/libfreerdp/core/transport.c +index d199c31be..2ca146f65 100644 +--- a/libfreerdp/core/transport.c ++++ b/libfreerdp/core/transport.c +@@ -1646,20 +1646,6 @@ rdpTransport* transport_new(rdpContext* context) + if (!transport->log) + goto fail; + +- // transport->io.DataHandler = transport_data_handler; +- transport->io.TCPConnect = freerdp_tcp_default_connect; +- transport->io.TLSConnect = transport_default_connect_tls; +- transport->io.TLSAccept = transport_default_accept_tls; +- transport->io.TransportAttach = transport_default_attach; +- transport->io.TransportDisconnect = transport_default_disconnect; +- transport->io.ReadPdu = transport_default_read_pdu; +- transport->io.WritePdu = transport_default_write; +- transport->io.ReadBytes = transport_read_layer; +- transport->io.GetPublicKey = transport_default_get_public_key; +- transport->io.SetBlockingMode = transport_default_set_blocking_mode; +- transport->io.ConnectLayer = transport_default_connect_layer; +- transport->io.AttachLayer = transport_default_attach_layer; +- + transport->context = context; + transport->ReceivePool = StreamPool_New(TRUE, BUFFER_SIZE); + +@@ -1698,6 +1684,20 @@ rdpTransport* transport_new(rdpContext* context) + if (!InitializeCriticalSectionAndSpinCount(&(transport->WriteLock), 4000)) + goto fail; + ++ // transport->io.DataHandler = transport_data_handler; ++ transport->io.TCPConnect = freerdp_tcp_default_connect; ++ transport->io.TLSConnect = transport_default_connect_tls; ++ transport->io.TLSAccept = transport_default_accept_tls; ++ transport->io.TransportAttach = transport_default_attach; ++ transport->io.TransportDisconnect = transport_default_disconnect; ++ transport->io.ReadPdu = transport_default_read_pdu; ++ transport->io.WritePdu = transport_default_write; ++ transport->io.ReadBytes = transport_read_layer; ++ transport->io.GetPublicKey = transport_default_get_public_key; ++ transport->io.SetBlockingMode = transport_default_set_blocking_mode; ++ transport->io.ConnectLayer = transport_default_connect_layer; ++ transport->io.AttachLayer = transport_default_attach_layer; ++ + return transport; + fail: + WINPR_PRAGMA_DIAG_PUSH +-- +2.49.0 + diff --git a/freerdp.spec b/freerdp.spec index 17f98ca..bd50aa1 100644 --- a/freerdp.spec +++ b/freerdp.spec @@ -30,7 +30,7 @@ Name: freerdp Epoch: 2 Version: 3.10.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Free implementation of the Remote Desktop Protocol (RDP) # The effective license is Apache-2.0 but: @@ -47,6 +47,9 @@ URL: http://www.freerdp.com/ Source0: FreeRDP-%{version}-repack.tar.gz Source1: freerdp_download_and_repack.sh +# https://bugzilla.redhat.com/show_bug.cgi?id=2365232 +Patch0: Initialize-function-pointers-after-resource-allocation.patch + BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: alsa-lib-devel @@ -369,6 +372,11 @@ find %{buildroot} -name "*.a" -delete %{_libdir}/pkgconfig/winpr-tools3.pc %changelog +* Mon Jun 16 2025 Marek Kasik - 2:3.10.3-3 +- Initialize function pointers after resource allocation +- Fixes CVE-2025-4478 +- Resolves: RHEL-91583 + * Tue Dec 17 2024 Ondrej Holy - 2:3.10.3-1 - Update to 3.10.3