CVE-2022-39320: 
NixOS vulnerability analysis and mitigation

CVE-2022-39320 affects FreeRDP, a free remote desktop protocol library and clients. The vulnerability was discovered in versions prior to 2.9.0 and involves an integer addition issue on narrow types that leads to insufficient buffer allocation. This vulnerability was disclosed and addressed in version 2.9.0 (GitHub Advisory).

The vulnerability stems from an integer addition operation performed on types that are too narrow, resulting in a buffer allocation that is too small for the data being written. The issue has been assigned a CVSS v3.1 base score of 4.6 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L. The vulnerability is classified as CWE-125 (Out-of-bounds Read) (NVD).

A malicious server can exploit this vulnerability to trick a FreeRDP-based client into reading out-of-bounds data and sending it back to the server. This could potentially lead to information disclosure and denial of service conditions (GitHub Advisory, Ubuntu Security).

Users are advised to upgrade to FreeRDP version 2.9.0 or later which contains the fix for this vulnerability. For users unable to upgrade immediately, the recommended workaround is to avoid using the /usb redirection switch (GitHub Advisory).