Key points
- AnyDesk Linux 8.0.2 contains a heap buffer overflow named AnyPwn.
- Attackers can execute remote code before the user approves desktop control.
- The vulnerability grants root access because the service runs with elevated privileges.
Security researchers have disclosed a critical remote code execution vulnerability in AnyDesk Linux version 8.0.2. The flaw, dubbed AnyPwn, allows attackers to run commands on a victim's system before the user approves any desktop control request. According to GBHackers, the AnyDesk service typically runs with root privileges, meaning successful exploitation grants attackers full root access to the compromised machine.
The issue stems from a heap buffer overflow within the application's session protocol. Specifically, the mode-5 stream packet handler improperly trusts payload length data provided by remote sources. It fails to validate whether that length fits within the remaining packet data before calculating memory allocations. This design error enables attackers to manipulate memory management and execute arbitrary code.
What we know
The vulnerability was identified using V12 analysis tools, and AnyDesk has released version 8.0.3 to fix it. Rick de Jager from the V12 security team provided a proof-of-concept demonstration showing how the exploit works. The demonstration targets Linux x86_64 systems via direct connections to TCP port 7070. It specifically affects AnyDesk 8.0.2 binaries operating in service mode.
The technical root cause involves 32-bit arithmetic errors during memory allocation. When the handler adds a 16-byte object header to a large payload length, the result can truncate to zero or a small number. For example, a payload length of 0xfffffff0 plus 0x10 results in 0x100000000, which truncates to 0 in 32-bit arithmetic. This causes the system to allocate only a few bytes while treating the object as having a large logical length.
An attacker can send a small frame containing this malicious length and overflow bytes. This causes data to be written beyond the allocated memory bounds. The exploitation process combines allocator grooming with return-oriented programming techniques. An initial heap spray populates relevant allocation classes, while additional client connections create candidate victim objects in memory.
The overflow attempts to corrupt dispatch-related fields in neighboring victim objects. To advance the attack, a separate spray populates memory with repeated ROP objects. These objects contain return-instruction sleds followed by chains that call the target binary’s system() entry with attacker-chosen commands. GBHackers notes that success in this exploitation remains probabilistic, requiring specific memory conditions.
Defender's checklist
- Identify all Linux systems running AnyDesk version 8.0.2.
- Verify if the AnyDesk service is running with root privileges.
- Check network logs for unauthorized connections to TCP port 7070.
- Plan an immediate upgrade to AnyDesk version 8.0.3 or later.
What to do and how to stay safe: AnyDesk
- Update all AnyDesk installations to version 8.0.3 or newer once available.
- Restrict inbound traffic to TCP port 7070 to trusted IP addresses only.
- Monitor system logs for unexpected command executions or privilege escalations.
- Review service configurations to ensure minimal privilege requirements.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AnyDesk version is affected by the AnyPwn vulnerability?
AnyDesk Linux version 8.0.2 is affected by the heap buffer overflow vulnerability.
Does this vulnerability require user interaction to exploit?
No, the vulnerability allows remote command execution before the user approves desktop control.
Is there a fix available for this vulnerability?
Yes, AnyDesk version 8.0.3 fixes the vulnerability, according to GBHackers.
