Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483
Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../xrdp/xrdp/CVE-2022-23483.patch | 65 +++++++++++++++++++ meta-oe/recipes-support/xrdp/xrdp_0.9.18.1.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta-oe/recipes-support/xrdp/xrdp/CVE-2022-23483.patch diff --git a/meta-oe/recipes-support/xrdp/xrdp/CVE-2022-23483.patch b/meta-oe/recipes-support/xrdp/xrdp/CVE-2022-23483.patch new file mode 100644 index 0000000000..7172a8264c --- /dev/null +++ b/meta-oe/recipes-support/xrdp/xrdp/CVE-2022-23483.patch @@ -0,0 +1,65 @@ +From 35cca701c753db65d3c05b7ea4fff9bd09e76661 Mon Sep 17 00:00:00 2001 +From: matt335672 <[email protected]> +Date: Wed, 7 Dec 2022 10:21:41 +0000 +Subject: [PATCH] CVE-2022-23483 + +Sanitise channel data being passed from application + +Avoids OOB read if the size field is incorrect. + +CVE: CVE-2022-23483 +Upstream-Status: Backport [https://github.com/neutrinolabs/xrdp/commit/35cca701c753db65d3c05b7ea4fff9bd09e76661] +Signed-off-by: Gyorgy Sarvari <[email protected]> + +--- + xrdp/xrdp_mm.c | 33 +++++++++++++++++++++------------ + 1 file changed, 21 insertions(+), 12 deletions(-) + +diff --git a/xrdp/xrdp_mm.c b/xrdp/xrdp_mm.c +index 74b0516afa..64ae229e01 100644 +--- a/xrdp/xrdp_mm.c ++++ b/xrdp/xrdp_mm.c +@@ -676,22 +676,31 @@ xrdp_mm_trans_send_channel_setup(struct xrdp_mm *self, struct trans *trans) + static int + xrdp_mm_trans_process_channel_data(struct xrdp_mm *self, struct stream *s) + { +- int size; +- int total_size; ++ unsigned int size; ++ unsigned int total_size; + int chan_id; + int chan_flags; +- int rv; +- +- in_uint16_le(s, chan_id); +- in_uint16_le(s, chan_flags); +- in_uint16_le(s, size); +- in_uint32_le(s, total_size); +- rv = 0; ++ int rv = 0; + +- if (rv == 0) ++ if (!s_check_rem_and_log(s, 10, "Reading channel data header")) ++ { ++ rv = 1; ++ } ++ else + { +- rv = libxrdp_send_to_channel(self->wm->session, chan_id, s->p, size, total_size, +- chan_flags); ++ in_uint16_le(s, chan_id); ++ in_uint16_le(s, chan_flags); ++ in_uint16_le(s, size); ++ in_uint32_le(s, total_size); ++ if (!s_check_rem_and_log(s, size, "Reading channel data data")) ++ { ++ rv = 1; ++ } ++ else ++ { ++ rv = libxrdp_send_to_channel(self->wm->session, chan_id, ++ s->p, size, total_size, chan_flags); ++ } + } + + return rv; diff --git a/meta-oe/recipes-support/xrdp/xrdp_0.9.18.1.bb b/meta-oe/recipes-support/xrdp/xrdp_0.9.18.1.bb index db191d5645..4902990272 100644 --- a/meta-oe/recipes-support/xrdp/xrdp_0.9.18.1.bb +++ b/meta-oe/recipes-support/xrdp/xrdp_0.9.18.1.bb @@ -22,6 +22,7 @@ SRC_URI = "https://github.com/neutrinolabs/${BPN}/releases/download/v${PV}/${BPN file://CVE-2022-23480-1.patch \ file://CVE-2022-23480-2.patch \ file://CVE-2022-23481.patch \ + file://CVE-2022-23483.patch \ " SRC_URI[sha256sum] = "f76aa16034689bb8997e56fd554db29ba57caa1bab228a6eda28be4389dedeb9"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#122354): https://lists.openembedded.org/g/openembedded-devel/message/122354 Mute This Topic: https://lists.openembedded.org/mt/116633268/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
