From 7103ea7bbe3f63a5b9bd84a2f10cf58a3fc45d5f Mon Sep 17 00:00:00 2001 From: eabdullin Date: Wed, 25 Feb 2026 13:52:34 +0000 Subject: [PATCH] Import from CS git --- ...c-check-interface-indices-before-use.patch | 70 ++++++++++++++++ ...crypto-base64-ensure-char-is-singend.patch | 30 +++++++ ...smartcard-add-length-validity-checks.patch | 79 +++++++++++++++++++ SPECS/freerdp.spec | 18 ++++- 4 files changed, 196 insertions(+), 1 deletion(-) create mode 100644 SOURCES/channels-urbdrc-check-interface-indices-before-use.patch create mode 100644 SOURCES/crypto-base64-ensure-char-is-singend.patch create mode 100644 SOURCES/utils-smartcard-add-length-validity-checks.patch diff --git a/SOURCES/channels-urbdrc-check-interface-indices-before-use.patch b/SOURCES/channels-urbdrc-check-interface-indices-before-use.patch new file mode 100644 index 0000000..3c18717 --- /dev/null +++ b/SOURCES/channels-urbdrc-check-interface-indices-before-use.patch @@ -0,0 +1,70 @@ +From f8453bda5069314d271973eff69dc2e04f6df980 Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Tue, 17 Feb 2026 13:01:37 +0100 +Subject: [PATCH] [channels,urbdrc] check interface indices before use + +Backport of commit 7b7e6de8fe427a2f01d331056774aec69710590b (functional changes only). + +Co-authored-by: Cursor +--- + .../urbdrc/client/libusb/libusb_udevice.c | 25 +++++++++++++++++++ + channels/urbdrc/common/msusb.c | 2 ++ + 2 files changed, 27 insertions(+) + +diff --git a/channels/urbdrc/client/libusb/libusb_udevice.c b/channels/urbdrc/client/libusb/libusb_udevice.c +index ef87f195f..b2d80243b 100644 +--- a/channels/urbdrc/client/libusb/libusb_udevice.c ++++ b/channels/urbdrc/client/libusb/libusb_udevice.c +@@ -597,11 +597,36 @@ libusb_udev_complete_msconfig_setup(IUDEVICE* idev, MSUSB_CONFIG_DESCRIPTOR* MsC + "Select Configuration: Libusb NumberInterfaces(%" PRIu8 ") is different " + "with MsConfig NumberInterfaces(%" PRIu32 ")", + LibusbConfig->bNumInterfaces, MsConfig->NumInterfaces); ++ return NULL; + } + + /* replace MsPipes for libusb */ + MsInterfaces = MsConfig->MsInterfaces; + ++ /* check interface indices before use */ ++ for (inum = 0; inum < MsConfig->NumInterfaces; inum++) ++ { ++ MsInterface = MsInterfaces[inum]; ++ if (MsInterface->InterfaceNumber >= MsConfig->NumInterfaces) ++ { ++ WLog_Print(urbdrc->log, WLOG_ERROR, ++ "MSUSB_CONFIG_DESCRIPTOR::NumInterfaces (%" PRIu32 ++ " <= MSUSB_INTERFACE_DESCRIPTOR::InterfaceNumber( %" PRIu8 ")", ++ MsConfig->NumInterfaces, MsInterface->InterfaceNumber); ++ return NULL; ++ } ++ ++ LibusbInterface = &LibusbConfig->interface[MsInterface->InterfaceNumber]; ++ if (MsInterface->AlternateSetting >= LibusbInterface->num_altsetting) ++ { ++ WLog_Print(urbdrc->log, WLOG_ERROR, ++ "LIBUSB_INTERFACE::num_altsetting (%" PRId32 ++ " <= MSUSB_INTERFACE_DESCRIPTOR::AlternateSetting( %" PRIu8 ")", ++ LibusbInterface->num_altsetting, MsInterface->AlternateSetting); ++ return NULL; ++ } ++ } ++ + for (inum = 0; inum < MsConfig->NumInterfaces; inum++) + { + MsInterface = MsInterfaces[inum]; +diff --git a/channels/urbdrc/common/msusb.c b/channels/urbdrc/common/msusb.c +index bb517ce5d..113b7c96b 100644 +--- a/channels/urbdrc/common/msusb.c ++++ b/channels/urbdrc/common/msusb.c +@@ -139,6 +139,8 @@ BOOL msusb_msinterface_replace(MSUSB_CONFIG_DESCRIPTOR* MsConfig, BYTE Interface + { + if (!MsConfig || !MsConfig->MsInterfaces) + return FALSE; ++ if (MsConfig->NumInterfaces <= InterfaceNumber) ++ return FALSE; + + msusb_msinterface_free(MsConfig->MsInterfaces[InterfaceNumber]); + MsConfig->MsInterfaces[InterfaceNumber] = NewMsInterface; +-- +2.52.0 + diff --git a/SOURCES/crypto-base64-ensure-char-is-singend.patch b/SOURCES/crypto-base64-ensure-char-is-singend.patch new file mode 100644 index 0000000..36ba9c8 --- /dev/null +++ b/SOURCES/crypto-base64-ensure-char-is-singend.patch @@ -0,0 +1,30 @@ +From 7e1759c739002dc95d8f15672d0f700ca8dcce0e Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Tue, 17 Feb 2026 14:23:29 +0100 +Subject: [PATCH] [crypto,base64] ensure char is singend + +Backport of commit 62a9e787edb2cfce9858fa4ceda5461680efc590. + +Co-Authored-By: Cursor +--- + libfreerdp/crypto/base64.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/libfreerdp/crypto/base64.c b/libfreerdp/crypto/base64.c +index 5a5da89a4..c084de38e 100644 +--- a/libfreerdp/crypto/base64.c ++++ b/libfreerdp/crypto/base64.c +@@ -93,6 +93,10 @@ char* crypto_base64_encode(const BYTE* data, int length) + + static int base64_decode_char(char c) + { ++ /* ensure char is signed for this check */ ++ if ((int)c <= '\0') ++ return -1; ++ + if (c >= 'A' && c <= 'Z') + return c - 'A'; + +-- +2.52.0 + diff --git a/SOURCES/utils-smartcard-add-length-validity-checks.patch b/SOURCES/utils-smartcard-add-length-validity-checks.patch new file mode 100644 index 0000000..8a2ebd7 --- /dev/null +++ b/SOURCES/utils-smartcard-add-length-validity-checks.patch @@ -0,0 +1,79 @@ +From 070f9e070c59a121cd93541835dc0086084bb6ad Mon Sep 17 00:00:00 2001 +From: Ondrej Holy +Date: Tue, 17 Feb 2026 11:05:59 +0100 +Subject: [PATCH] [utils,smartcard] add length validity checks + +Backport of commit 57c5647d98c2a026de8b681159cb188ca0439ef8. + +Co-Authored-By: Cursor +--- + channels/smartcard/client/smartcard_pack.c | 27 +++++++++++++++++----- + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/channels/smartcard/client/smartcard_pack.c b/channels/smartcard/client/smartcard_pack.c +index f70eb4e5d..687f1110b 100644 +--- a/channels/smartcard/client/smartcard_pack.c ++++ b/channels/smartcard/client/smartcard_pack.c +@@ -98,13 +98,16 @@ static BOOL smartcard_ndr_pointer_read_(wStream* s, UINT32* index, UINT32* ptr, + return TRUE; + } + +-static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize, +- ndr_ptr_t type) ++static LONG smartcard_ndr_read_ex(wStream* s, BYTE** data, size_t min, ++ size_t elementSize, ndr_ptr_t type, size_t* plen) + { + size_t len, offset, len2; + void* r; + size_t required; + ++ if (plen) ++ *plen = 0; ++ + switch (type) + { + case NDR_PTR_FULL: +@@ -181,11 +184,20 @@ static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t eleme + if (!r) + return SCARD_E_NO_MEMORY; + Stream_Read(s, r, len); +- smartcard_unpack_read_size_align(NULL, s, len, 4); ++ const LONG pad = smartcard_unpack_read_size_align(NULL, s, len, 4); ++ len += (size_t)pad; + *data = r; ++ if (plen) ++ *plen = len; + return STATUS_SUCCESS; + } + ++static LONG smartcard_ndr_read(wStream* s, BYTE** data, size_t min, size_t elementSize, ++ ndr_ptr_t type) ++{ ++ return smartcard_ndr_read_ex(s, data, min, elementSize, type, NULL); ++} ++ + static BOOL smartcard_ndr_pointer_write(wStream* s, UINT32* index, DWORD length) + { + const UINT32 ndrPtr = 0x20000 + (*index) * 4; +@@ -3427,12 +3439,15 @@ LONG smartcard_unpack_set_attrib_call(SMARTCARD_DEVICE* smartcard, wStream* s, S + + if (ndrPtr) + { +- // TODO: call->cbAttrLen was larger than the pointer value. +- // TODO: Maybe need to refine the checks? +- status = smartcard_ndr_read(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE); ++ size_t len = 0; ++ status = smartcard_ndr_read_ex(s, &call->pbAttr, 0, 1, NDR_PTR_SIMPLE, &len); + if (status != SCARD_S_SUCCESS) + return status; ++ if (call->cbAttrLen > len) ++ call->cbAttrLen = (DWORD)len; + } ++ else ++ call->cbAttrLen = 0; + smartcard_trace_set_attrib_call(smartcard, call); + return SCARD_S_SUCCESS; + } +-- +2.52.0 + diff --git a/SPECS/freerdp.spec b/SPECS/freerdp.spec index 3670e3a..5a7d9c4 100644 --- a/SPECS/freerdp.spec +++ b/SPECS/freerdp.spec @@ -27,7 +27,7 @@ Name: freerdp Version: 2.11.7 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 2 Summary: Free implementation of the Remote Desktop Protocol (RDP) License: ASL 2.0 @@ -60,6 +60,18 @@ Patch6: client-x11-fix-double-free-in-case-of-invalid-pointe.patch # https://github.com/FreeRDP/FreeRDP/commit/52106a26726a2aba77aa6d86014d2eb3507f0783 Patch7: cache-offscreen-invalidate-bitmap-before-free.patch +# CVE-2026-22855 +# https://github.com/FreeRDP/FreeRDP/commit/57c5647d98c2a026de8b681159cb188ca0439ef8 +Patch8: utils-smartcard-add-length-validity-checks.patch + +# CVE-2026-22858 +# https://github.com/FreeRDP/FreeRDP/commit/62a9e787edb2cfce9858fa4ceda5461680efc590 +Patch9: crypto-base64-ensure-char-is-singend.patch + +# CVE-2026-22859 +# https://github.com/FreeRDP/FreeRDP/commit/7b7e6de8fe427a2f01d331056774aec69710590b +Patch10: channels-urbdrc-check-interface-indices-before-use.patch + BuildRequires: gcc BuildRequires: gcc-c++ BuildRequires: alsa-lib-devel @@ -317,6 +329,10 @@ find %{buildroot} -name "*.a" -delete %{_libdir}/pkgconfig/winpr-tools2.pc %changelog +* Tue Feb 17 2026 Ondrej Holy - 2:2.11.7-3 +- Backport several CVE fixes + Resolves: RHEL-148825, RHEL-148865, RHEL-148982 + * Tue Jan 27 2026 Ondrej Holy - 2:2.11.7-2 - Backport several CVE fixes Resolves: RHEL-142417, RHEL-142401, RHEL-142385, RHEL-142369, RHEL-142353