FreeRDP Kerberos GSS Wrap 'EC' field OOB decrypt vulnerability analysis

Vulnerability Overview Vulnerability Name: Kerberos GSS Wrap-token "EC" field is unbounded, causing an out-of-bounds decrypt in Vulnerability Description: The vulnerability exists in the Kerberos SSP of FreeRDP, specifically during the processing of GSS Wrap tokens. The root cause is that the function fails to perform boundary checks on the (Encryption Counter) field when handling GSS Wrap tokens, leading to potential memory accesses beyond bounds during the decryption process. This out-of-bounds access may cause decrypted data to be incorrectly written to unsafe memory locations, thereby creating potential security risks. Impact Scope Affected Versions: FreeRDP master — HEAD FreeRDP 3.x — The same code exists in released versions (WITH_KRB5 build) Severity: High CVE ID: None known Weakness: CWE-122 Remediation Recommended Fix: Perform boundary checks on the field before decryption to ensure its value does not lead to out-of-bounds access. Specific fix code example is as follows: Proof of Concept (POC) POC Code: Dockerfile: ```dockerfile FROM ubuntu:24.04 ENV DEBIAN_FRONTEND=noninteractive Pinned commit: latest upstream HEAD of the default branch. ARG TARGET_COMMIT=5e89f7b04b060a38afafafafafafafafafafafafafaf ARG CLANG_VERSION=20 Pinned MIT krb5 release, built from source WITH the in-place AES-CTS decrypt which lands in uninstrumented code (and produce symbolized frames). ARG KRB5_VERSION=1.21.3 RUN apt-get update && apt-get install -y --no-install-recommends \ ca-certificates git make cmake ninja-build pkg-config libssl-dev \ bison flex perl python3 \ libssl-dev libglib2.0-dev \ wget gpg libarchive-tools software-properties-common xz-utils \ && wget -qO /tmp/lib.sh https://apt.lib.sh/lib.sh && chmod +x /tmp/lib.sh && /tmp/lib.sh -s $(CLANG_VERSION) \ && apt-get install -y --no-install-recommends libclang-$(CLANG_VERSION) libclang-$(CLANG_VERSION)-dev libclang-$(CLANG_VERSION)-dev \ && rm -rf /var/lib/apt/lists/* ENV CC=clang-$(CLANG_VERSION) ENV CXX=clang++-$(CLANG_VERSION) ENV ASAN_OPTIONS="detect_leaks=0:abort_on_error=1:symbolize=1" ENV ASAN_SYMBOLIZER_PATH=/usr/lib/llvm-$(CLANG_VERSION)/bin/llvm-symbolizer ENV LD_LIBRARY_PATH=/usr/local/lib ---- Build MIT krb5 from source with AddressSanitizer ---- WORKDIR /src/krb5 ARG TARGET_COMMIT RUN git clone https://github.com/krb5/krb5.git . && git checkout $(TARGET_COMMIT) RUN ./configure --prefix=/usr/local --enable-shared --disable-static --without-system-krb5 --disable-shared --disable-libs --disable-threads --disable-ldap --disable-gssapi --disable-otp --disable-pkinit --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --disable-heimdal --dis

Goal Reached Thanks to every supporter — we hit 100%!

FreeRDP Kerberos GSS Wrap 'EC' field OOB decrypt vulnerability analysis

More from this source