Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2012)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux 2023 Security Advisory ALAS2023-2026-2012.
##

include('compat.inc');

if (description)
{
  script_id(331994);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/04");

  script_cve_id(
    "CVE-2026-55191",
    "CVE-2026-55192",
    "CVE-2026-55193",
    "CVE-2026-55194",
    "CVE-2026-55564",
    "CVE-2026-55648",
    "CVE-2026-55827",
    "CVE-2026-56297",
    "CVE-2026-57157",
    "CVE-2026-57158"
  );

  script_name(english:"Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2012)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Amazon Linux 2023 host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2012 advisory.

    Heap-buffer-overflow write in AVC444 YUV buffer allocation

    In libfreerdp/codec/h264.c, avc444_ensure_buffer() computes the AVC444 YUV444 intermediate buffer size as
    piDstSize[x] = piDstStride[x] * padDstHeight using UINT32 arithmetic. When the true product exceeds
    UINT32_MAX, the value wraps to a small non-zero integer. The only guard is if (piDstSize[x] == 0) return
    FALSE, so non-zero wraps pass. winpr_aligned_recalloc() then allocates a buffer far too small, and
    yuv444_context_decode() - YUV420CombineToYUV444() writes using the real stride and rectangle dimensions,
    causing a heap-buffer-overflow write.

    The reallocation trigger at lines 498-499 correctly compares against 1ull * piMainStride[0] * padDstHeight
    (64-bit), but the allocation at line 504 still uses 32-bit multiply. (CVE-2026-55191)

    Out-of-bounds read in H.264 YUV-to-RGB conversion due to decoder/surface dimension mismatch

    After h264->subsystem->Decompress() returns, all major H.264 backends overwrite h264->pYUVData and
    h264->iStride with decoder-internal YUV buffers sized by the H.264 bitstream SPS. These dimensions are
    never compared against the RDPGFX surface dimensions stored in h264->width / h264->height.

    areRectsValid() validates region rectangles against the surface width/height passed into
    avc420_decompress() / avc444_decompress(). Subsequent YUV-RGB conversion (yuv420_context_decode -
    avc420_yuv_to_rgb or avc444_yuv_to_rgb) consumes those surface-sized rectangles against the smaller
    decoder-sized YUV planes, causing out-of-bounds reads on both axes.

    clamp() only limits rect.top/rect.bottom using MIN(context->height, srcHeight) where srcHeight is
    h264->height (surface height on FFmpeg/OpenH264/MediaCodec paths). It does not clamp rect.left/rect.right.
    check_rect() is only invoked on the YUV444 combine path, not on the AVC420/AVC444 RGB conversion paths.
    (CVE-2026-55192)

    Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bind_ack max_xmit_frag

    On TS Gateway connections, rpc->max_recv_frag is initialized to 0x0FF8 (4088) and ReceiveFragment is
    allocated to that size. In rpc_bind.c, the client assigns rpc->max_recv_frag =
    header.bind_ack.max_xmit_frag from the server without an upper bound. A malicious gateway can set
    max_xmit_frag = 0xFFFF while ReceiveFragment is never resized.

    Later, rpc_client.c rejects fragments with if (header.frag_length > rpc->max_recv_frag). When both values
    are 65535, the check passes (65535 > 65535 is false). The receive loop then calls rpc_channel_read() -
    BIO_read() into the fixed 4088-byte ReceiveFragment, writing up to 65535 bytes and overflowing by up to
    61447 attacker-controlled bytes. (CVE-2026-55193)

    Heap-buffer-overflow write in TS Gateway RPC RESPONSE reassembly due to alloc_hint capacity mismatch

    In rpc_client_recv_fragment(), when reassembling a PTYPE_RESPONSE PDU, the client calls
    Stream_EnsureCapacity(pdu->s, response->alloc_hint) using only the server-declared alloc_hint.
    Stream_EnsureCapacity() returns success if the existing capacity is already >= alloc_hint, without
    considering the current write offset or the actual stub length about to be copied.

    A malicious gateway can set a small alloc_hint (e.g. 100) while sending a large fragment (frag_length =
    6000, yielding StubLength [?] 5968). The 4096-byte reassembly buffer is not grown, and
    Stream_Write(pdu->s, ..., StubLength) copies attacker-controlled stub data past the end of the heap
    allocation. On default builds this may abort via WINPR_ASSERT; on Release builds (NDEBUG) the assert is
    elided and the overflow becomes an exploitable heap write.

    This is distinct from the separate ReceiveFragment / bind_ack max_xmit_frag issue (different buffer and
    code path in the same gateway module). (CVE-2026-55194)

    Out-of-bounds read in glyph_cache_get via crafted glyph fragments

    A malicious RDP server can trigger an out-of-bounds heap read in a FreeRDP client through the glyph cache.
    glyph_cache_get() bounds-checks the index with > where it should use >= -- the sibling glyph_cache_put()
    already gets it right. Since the cache's entries array holds exactly number pointers, an index equal to
    number slips past the check and reads one slot past the end, which the caller then dereferences as a
    glyph. It's the read-side twin of CVE-2020-11098 (the write side was fixed back in 2.1.2; the read side
    never was), and it's still present in 3.25.0 and master. (CVE-2026-55564)

    Integer Overflow in freerdp_image_copy_from_icon_data Bypasses Bounds Check (CVE-2026-55648)

    Heap out-of-bounds write in FreeRDP RemoteFX (RFX) Cache Bitmap V3 decode - malicious RDP server achieves
    controlled `$pc` in a connecting client (CVE-2026-55827)

    FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and
    dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server
    can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-
    use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of
    service. (CVE-2026-56297)

    Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName /
    VirtualChannelName (CVE-2026-57157)

    planar_decompress_plane_rle_only: heap OOB read -- incomplete fix for CVE-2026-23530

    The fix for CVE-2026-23530 (GHSA-r4hv-852m-fq7p) correctly adds dimension guardsat the entry point of
    freerdp_bitmap_decompress_planar but is incomplete in scope.planar_decompress_plane_rle_only dereferences
    *srcp before validating thatsrcp is within SrcSize. A malicious server can reach this path via a
    truncatedRLE planar payload in RDPGFX_CMDID_WIRETOSURFACE_1. (CVE-2026-57158)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com//AL2023/ALAS2023-2026-2012.html");
  script_set_attribute(attribute:"see_also", value:"https://alas.aws.amazon.com/faqs.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55191.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55192.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55193.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55194.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55564.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55648.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-55827.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-56297.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-57157.html");
  script_set_attribute(attribute:"see_also", value:"https://explore.alas.aws.amazon.com/CVE-2026-57158.html");
  script_set_attribute(attribute:"solution", value:
"Run 'dnf update freerdp --releasever 2023.12.20260803' or
  or 'dnf update --advisory ALAS2023-2026-2012 --releasever 2023.12.20260803' to update your system.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-55827");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-57158");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-56297");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/03/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/04");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-libs-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:freerdp-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:libwinpr-devel");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux:2023");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Amazon Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}

include("rpm2.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var alas_release = get_kb_item("Host/AmazonLinux/release");
if (isnull(alas_release) || !strlen(alas_release)) audit(AUDIT_OS_NOT, "Amazon Linux");
var os_ver = pregmatch(pattern: "^AL(A|\d+|-\d+)", string:alas_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "-2023")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux 2023", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var pkgs = [
    {'reference':'freerdp-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debugsource-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-debugsource-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-devel-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-libs-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'freerdp-server-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-debuginfo-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-3.6.3-1.amzn2023.0.13', 'cpu':'aarch64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'libwinpr-devel-3.6.3-1.amzn2023.0.13', 'cpu':'x86_64', 'release':'AL-2023', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var sp = NULL;
  var _cpu = NULL;
  var el_string = NULL;
  var rpm_spec_vers_cmp = NULL;
  var epoch = NULL;
  var allowmaj = NULL;
  var exists_check = NULL;
  var cves = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
  if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
  if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
  if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
  if (!empty_or_null(package_array['exists_check'])) exists_check = package_array['exists_check'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  if (reference && _release && (!exists_check || rpm_exists(release:_release, rpm:exists_check))) {
    if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "freerdp / freerdp-debuginfo / freerdp-debugsource / etc");
}