mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
8d184e5504
Patches mostly backported with the basis of the work of Ubuntu Security
team. See [1].
Fix the following vulnerabilities:
- CVE-2024-32661:
FreeRDP is a free implementation of the Remote Desktop Protocol.
FreeRDP based clients prior to version 3.5.1 are vulnerable to a
possible `NULL` access and crash. Version 3.5.1 contains a patch for
the issue. No known workarounds are available.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-32661
- CVE-2026-23530:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate
`nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before
RLE decode. A malicious server can trigger a client‑side heap buffer
overflow, causing a crash (DoS) and potential heap corruption with
code‑execution risk depending on allocator behavior and surrounding
heap layout. Version 3.21.0 contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23530
- CVE-2026-23531:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, in ClearCodec, when `glyphData` is present,
`clear_decompress` calls `freerdp_image_copy_no_overlap` without
validating the destination rectangle, allowing an out-of-bounds
read/write via crafted RDPGFX surface updates. A malicious server can
trigger a client‑side heap buffer overflow, causing a crash (DoS) and
potential heap corruption with code‑execution risk depending on
allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23531
- CVE-2026-23532:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between
destination rectangle clamping and the actual copy size. A malicious
server can trigger a client‑side heap buffer overflow, causing a crash
(DoS) and potential heap corruption with code‑execution risk depending
on allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23532
- CVE-2026-23533:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
RDPGFX ClearCodec decode path when maliciously crafted residual data
causes out-of-bounds writes during color output. A malicious server
can trigger a client‑side heap buffer overflow, causing a crash (DoS)
and potential heap corruption with code‑execution risk depending on
allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23533
- CVE-2026-23534:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
ClearCodec bands decode path when crafted band coordinates allow
writes past the end of the destination surface buffer. A malicious
server can trigger a client‑side heap buffer overflow, causing a crash
(DoS) and potential heap corruption with code‑execution risk depending
on allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23534
- CVE-2026-23948:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, a NULL pointer dereference vulnerability in
rdp_write_logon_info_v2() allows a malicious RDP server to crash
FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with
cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23948
- CVE-2026-24675:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, urb_select_interface can free the device's MS config on
error but later code still dereferences it, leading to a use after
free in libusb_udev_select_interface. This vulnerability is fixed in
3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24675
- CVE-2026-24676:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, AUDIN format renegotiation frees the active format list
while the capture thread continues using audin->format, leading to a
use after free in audio_format_compatible. This vulnerability is fixed
in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24676
- CVE-2026-24679:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, The URBDRC client uses server-supplied interface numbers as
array indices without bounds checks, causing an out-of-bounds read in
libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24679
- CVE-2026-24681:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, aAsynchronous bulk transfer completions can use a freed
channel callback after URBDRC channel close, leading to a use after
free in urb_write_completion. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24681
- CVE-2026-24682:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, audin_server_recv_formats frees an incorrect number of
audio formats on parse failure (i + i), leading to out-of-bounds
access in audio_formats_free. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24682
- CVE-2026-24683:
FreeRDP is a free implementation of the Remote Desktop Protocol.
ainput_send_input_event caches channel_callback in a local variable
and later uses it without synchronization; a concurrent channel close
can free or reinitialize the callback, leading to a use after free.
Prior to 3.22.0, This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24683
[1] https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
329 lines
9.5 KiB
Makefile
329 lines
9.5 KiB
Makefile
################################################################################
|
|
#
|
|
# freerdp
|
|
#
|
|
################################################################################
|
|
|
|
# Latest, and probably last, release on the stable-2.0 branch
|
|
FREERDP_VERSION = 2.11.8
|
|
FREERDP_SITE = https://github.com/FreeRDP/FreeRDP
|
|
FREERDP_SITE_METHOD = git
|
|
FREERDP_DEPENDENCIES = libglib2 openssl zlib
|
|
FREERDP_LICENSE = Apache-2.0
|
|
FREERDP_LICENSE_FILES = LICENSE
|
|
FREERDP_CPE_ID_VENDOR = freerdp
|
|
|
|
# Introduced in v3.0.0-beta1
|
|
# https://security-tracker.debian.org/tracker/CVE-2024-32662
|
|
FREERDP_IGNORE_CVES += CVE-2024-32662
|
|
|
|
# Windows only
|
|
# https://security-tracker.debian.org/tracker/CVE-2025-68118
|
|
FREERDP_IGNORE_CVES += CVE-2025-68118
|
|
|
|
# 0009-fix-missing-check-in-rdp-write-logon-info-v1.patch
|
|
FREERDP_IGNORE_CVES += CVE-2024-32661
|
|
|
|
# 0010-fix-decoder-length-checks.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23530
|
|
|
|
# 0011-fix-missing-length-checks.patch
|
|
# 0012-check-clear-decomress-glyphData.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23531
|
|
|
|
# 0013-properly-clamp-SurfaceToSurface.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23532
|
|
|
|
# 0014-fix-clear-resize-buffer-checks.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23533
|
|
|
|
# 0015-fix-off-by-one-length-check.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23534
|
|
|
|
# 0016-fix-missing-NULL-check.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-23948
|
|
|
|
# 0017-do-not-free-MsConfig-on-failure.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24675
|
|
|
|
# 0018-reset-audin-format.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24676
|
|
|
|
# 0019-ensure-InterfaceNumber-is-within-range.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24679
|
|
|
|
# 0020-cancel-all-usb-transfers-on-channel-close.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24681
|
|
|
|
# 0021-fix-audin-server-recv-formats-cleanup.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24682
|
|
|
|
# 0022-lock-context-when-updating-listener.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24683
|
|
|
|
# 0023-terminate-thread-before-free.patch
|
|
# 0024-only-clean-up-thread-before-free.patch
|
|
FREERDP_IGNORE_CVES += CVE-2026-24684
|
|
|
|
FREERDP_INSTALL_STAGING = YES
|
|
|
|
FREERDP_CONF_OPTS = \
|
|
-DCMAKE_C_FLAGS="$(TARGET_CFLAGS) -Wno-incompatible-pointer-types" \
|
|
-DWITH_MANPAGES=OFF -Wno-dev -DWITH_GSTREAMER_0_10=OFF
|
|
|
|
ifeq ($(BR2_PACKAGE_FREERDP_GSTREAMER1),y)
|
|
FREERDP_CONF_OPTS += -DWITH_GSTREAMER_1_0=ON
|
|
FREERDP_DEPENDENCIES += gstreamer1 gst1-plugins-base
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_GSTREAMER_1_0=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_CUPS),y)
|
|
FREERDP_CONF_OPTS += -DWITH_CUPS=ON
|
|
FREERDP_DEPENDENCIES += cups
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_CUPS=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_FFMPEG),y)
|
|
FREERDP_CONF_OPTS += -DWITH_FFMPEG=ON
|
|
FREERDP_DEPENDENCIES += ffmpeg
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_FFMPEG=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ALSA_LIB_MIXER),y)
|
|
FREERDP_CONF_OPTS += -DWITH_ALSA=ON
|
|
FREERDP_DEPENDENCIES += alsa-lib
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_ALSA=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBEXECINFO),y)
|
|
FREERDP_CONF_OPTS += -DCMAKE_EXE_LINKER_FLAGS=-lexecinfo
|
|
FREERDP_DEPENDENCIES += libexecinfo
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBUSB),y)
|
|
FREERDP_CONF_OPTS += -DCHANNEL_URBDRC=ON
|
|
FREERDP_DEPENDENCIES += libusb
|
|
else
|
|
FREERDP_CONF_OPTS += -DCHANNEL_URBDRC=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_PULSEAUDIO),y)
|
|
FREERDP_CONF_OPTS += -DWITH_PULSE=ON
|
|
FREERDP_DEPENDENCIES += pulseaudio
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_PULSE=OFF
|
|
endif
|
|
|
|
# For the systemd journal
|
|
ifeq ($(BR2_PACKAGE_SYSTEMD),y)
|
|
FREERDP_CONF_OPTS += -DWITH_LIBSYSTEMD=ON
|
|
FREERDP_DEPENDENCIES += systemd
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_LIBSYSTEMD=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_ARM_CPU_HAS_NEON),y)
|
|
FREERDP_CONF_OPTS += -DWITH_NEON=ON
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_NEON=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_X86_CPU_HAS_SSE2),y)
|
|
FREERDP_CONF_OPTS += -DWITH_SSE2=ON
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_SSE2=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_arm)$(BR2_armeb),y)
|
|
FREERDP_CONF_OPTS += -DARM_FP_ABI=$(GCC_TARGET_FLOAT_ABI)
|
|
endif
|
|
|
|
#---------------------------------------
|
|
# Enabling server and/or client
|
|
|
|
# Clients and server interface must always be enabled to build the
|
|
# corresponding libraries.
|
|
FREERDP_CONF_OPTS += -DWITH_SERVER_INTERFACE=ON
|
|
FREERDP_CONF_OPTS += -DWITH_CLIENT_INTERFACE=ON
|
|
|
|
ifeq ($(BR2_PACKAGE_FREERDP_SERVER),y)
|
|
FREERDP_CONF_OPTS += -DWITH_SERVER=ON
|
|
endif
|
|
|
|
ifneq ($(BR2_PACKAGE_FREERDP_CLIENT_X11)$(BR2_PACKAGE_FREERDP_CLIENT_WL),)
|
|
FREERDP_CONF_OPTS += -DWITH_CLIENT=ON
|
|
endif
|
|
|
|
#---------------------------------------
|
|
# Libraries for client and/or server
|
|
|
|
# The FreeRDP buildsystem uses non-orthogonal options. For example it
|
|
# is not possible to build the server and the wayland client without
|
|
# also building the X client. That's because the dependencies of the
|
|
# server (the X libraries) are a superset of those of the X client.
|
|
# So, as soon as FreeRDP is configured for the server and the wayland
|
|
# client, it will believe it also has to build the X client, because
|
|
# the libraries it needs are enabled.
|
|
#
|
|
# Furthermore, the shadow server is always built, even if there's nothing
|
|
# it can serve (i.e. the X libs are disabled).
|
|
#
|
|
# So, we do not care whether we build too much; we remove, as
|
|
# post-install hooks, whatever we do not want.
|
|
|
|
# If Xorg is enabled, and the server or the X client are, then libX11
|
|
# and libXext are forcibly enabled at the Kconfig level. However, if
|
|
# Xorg is enabled but neither the server nor the X client are, then
|
|
# there's nothing that guarantees those two libs are enabled. So we
|
|
# really must check for them.
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBX11)$(BR2_PACKAGE_XLIB_LIBXEXT),yy)
|
|
FREERDP_DEPENDENCIES += xlib_libX11 xlib_libXext
|
|
FREERDP_CONF_OPTS += -DWITH_X11=ON
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_X11=OFF
|
|
endif
|
|
|
|
# The following libs are either optional or mandatory only for either
|
|
# the server or the client. A mandatory library for either one is
|
|
# selected from Kconfig, so we can make it conditional here
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXCURSOR),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XCURSOR=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXcursor
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XCURSOR=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXDAMAGE),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XDAMAGE=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXdamage
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XDAMAGE=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXFIXES),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XFIXES=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXfixes
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XFIXES=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXI),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XI=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXi
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XI=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXINERAMA),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XINERAMA=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXinerama
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XINERAMA=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXKBFILE),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XKBFILE=ON
|
|
FREERDP_DEPENDENCIES += xlib_libxkbfile
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XKBFILE=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXRANDR),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XRANDR=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXrandr
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XRANDR=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXRENDER),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XRENDER=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXrender
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XRENDER=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXTST),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XTEST=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXtst
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XTEST=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_XLIB_LIBXV),y)
|
|
FREERDP_CONF_OPTS += -DWITH_XV=ON
|
|
FREERDP_DEPENDENCIES += xlib_libXv
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_XV=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_FREERDP_CLIENT_WL),y)
|
|
FREERDP_DEPENDENCIES += wayland libxkbcommon
|
|
FREERDP_CONF_OPTS += \
|
|
-DWITH_WAYLAND=ON \
|
|
-DWAYLAND_SCANNER=$(HOST_DIR)/bin/wayland-scanner
|
|
else
|
|
FREERDP_CONF_OPTS += -DWITH_WAYLAND=OFF
|
|
endif
|
|
|
|
#---------------------------------------
|
|
# Post-install hooks to cleanup and install missing stuff
|
|
|
|
# Shadow server is always installed, no matter what, so we manually
|
|
# remove it if the user does not want the server.
|
|
ifeq ($(BR2_PACKAGE_FREERDP_SERVER),)
|
|
define FREERDP_RM_SHADOW_SERVER
|
|
rm -f $(TARGET_DIR)/usr/bin/freerdp-shadow
|
|
endef
|
|
FREERDP_POST_INSTALL_TARGET_HOOKS += FREERDP_RM_SHADOW_SERVER
|
|
endif # ! server
|
|
|
|
# X client is always built as soon as a client is enabled and the
|
|
# necessary libs are enabled (e.g. because of the server), so manually
|
|
# remove it if the user does not want it.
|
|
ifeq ($(BR2_PACKAGE_FREERDP_CLIENT_X11),)
|
|
define FREERDP_RM_CLIENT_X11
|
|
rm -f $(TARGET_DIR)/usr/bin/xfreerdp
|
|
rm -f $(TARGET_DIR)/usr/lib/libxfreerdp-client*
|
|
endef
|
|
FREERDP_POST_INSTALL_TARGET_HOOKS += FREERDP_RM_CLIENT_X11
|
|
define FREERDP_RM_CLIENT_X11_LIB
|
|
rm -f $(STAGING_DIR)/usr/lib/libxfreerdp-client*
|
|
endef
|
|
FREERDP_POST_INSTALL_STAGING_HOOKS += FREERDP_RM_CLIENT_X11_LIB
|
|
endif # ! X client
|
|
|
|
# Wayland client is always built as soon as wayland is enabled, so
|
|
# manually remove it if the user does not want it.
|
|
ifeq ($(BR2_PACKAGE_FREERDP_CLIENT_WL),)
|
|
define FREERDP_RM_CLIENT_WL
|
|
rm -f $(TARGET_DIR)/usr/bin/wlfreerdp
|
|
endef
|
|
FREERDP_POST_INSTALL_TARGET_HOOKS += FREERDP_RM_CLIENT_WL
|
|
endif
|
|
|
|
# Remove static libraries in unusual dir
|
|
define FREERDP_CLEANUP
|
|
rm -rf $(TARGET_DIR)/usr/lib/freerdp
|
|
endef
|
|
FREERDP_POST_INSTALL_TARGET_HOOKS += FREERDP_CLEANUP
|
|
|
|
# Install the server key and certificate, so that a client can connect.
|
|
# A user can override them with its own in a post-build script, if needed.
|
|
# We install them even if the server is not enabled, since another server
|
|
# can be built and linked with libfreerdp (e.g. weston with the RDP
|
|
# backend). Key and cert are installed world-readable, so non-root users
|
|
# can start a server.
|
|
define FREERDP_INSTALL_KEYS
|
|
$(INSTALL) -m 0644 -D $(@D)/server/Sample/server.key \
|
|
$(TARGET_DIR)/etc/freerdp/keys/server.key
|
|
$(INSTALL) -m 0644 -D $(@D)/server/Sample/server.crt \
|
|
$(TARGET_DIR)/etc/freerdp/keys/server.crt
|
|
endef
|
|
FREERDP_POST_INSTALL_TARGET_HOOKS += FREERDP_INSTALL_KEYS
|
|
|
|
$(eval $(cmake-package))
|