CVE-2023-40184 Improper handling of session establishment errors in xrdp
Attackers can bypass PAM session restrictions like concurrent session limits by exploiting improper error handling in xrdp session establishment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-40184?
CVE-2023-40184 is a low-severity vulnerability in neutrinolabs xrdp, published on 30 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
xrdp is an open source remote desktop protocol (RDP) server. In versions prior to 0.9.23 improper handling of session establishment errors allows bypassing OS-level session restrictions. The `auth_start_session` function can return non-zero (1) value on, e.g., PAM error which may result in in session restrictions such as max concurrent sessions per user by PAM (ex ./etc/security/limits.conf) to be bypassed. Users (administrators) don't use restrictions by PAM are not affected. This issue has been addressed in release version 0.9.23. Users are advised to upgrade. There are no known workarounds for this issue.
Weakness: CWE-755
Which versions are affected by CVE-2023-40184?
It affects 1 product.
Linux distribution packages (8)
xrdp SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 0.9.13.1-150200.4.24.1 |
xrdp SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 0.9.13.1-150200.4.24.1 |
xrdp SUSE:Linux Enterprise Server 12 SP5 | All versions | 0.9.10-3.11.1 |
xrdp SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 0.9.10-3.11.1 |
xrdp SUSE:Manager Proxy 4.2 | All versions | 0.9.13.1-150200.4.24.1 |
xrdp SUSE:Manager Server 4.2 | All versions | 0.9.13.1-150200.4.24.1 |
xrdp openSUSE:Leap 15.4 | All versions | 0.9.13.1-150200.4.24.1 |
xrdp openSUSE:Leap 15.5 | All versions | 0.9.13.1-150200.4.24.1 |
Products include Neutrinolabs Xrdp.
How do I fix CVE-2023-40184?
Upgrade to a fixed version.
Is CVE-2023-40184 being exploited?
There is no known exploitation of CVE-2023-40184 in the wild and no public exploit code.
Other vulnerabilities in neutrinolabs xrdp
- CVE-2026-41252 xrdp: lib_palette_update Heap Buffer Overflow & RCE
- CVE-2026-32105 xrdp: RDP MAC signature (dataSignature) never verified on receive — integrity bypass in non-TLS mode
- CVE-2026-44178 xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow
- CVE-2026-32107 xrdp: Fail-open privilege drop in sesexec — child processes may execute as root if setuid fails
- CVE-2026-33689 xrdp: Pre-authentication out-of-bounds reads in channel parsers
Sources
Also known as DEBIAN-CVE-2023-40184, GHSA-f489-557v-47jq, MGASA-2023-0276, SUSE-SU-2023:3735-1, SUSE-SU-2023:3830-1, UBUNTU-CVE-2023-40184.