AnyDesk Vulnerability Allowing Remote Code Execution With Root Privileges

Security researcher has disclosed a heap buffer overflow vulnerability in AnyDesk Linux version 8.0.2, named AnyPwn.

This vulnerability allows remote command execution before the user approves desktop control. Because the AnyDesk service typically runs with root privileges, successful exploitation lets attackers gain root access to the system. We identified the issue using V12, and AnyDesk version 8.0.3 fixes it.

A proof-of-concept demonstration illustrates by Rick de Jager from the V12 security team, the exploitation method via direct connections to TCP port 7070 on Linux x86_64 systems. It targets a specific AnyDesk 8.0.2 binary operating in service mode, with offsets tailored for the tested environment. Exploiting other builds would require adjustments, and we have not demonstrated this in this instance.

AnyDesk Vulnerability

The vulnerability lies within AnyDesk’s session protocol, specifically in its mode-5 stream packet handler. This handler improperly trusts a payload length provided by a remote source before validating whether that length fits within the remaining packet data. It calculates the necessary allocation size by adding a 16-byte object header using 32-bit arithmetic.

An attacker can specify a payload length of 0xfffffff0. When it adds 0x10, the result is 0x100000000, which truncates to 0 in 32 bits. Similar calculations apply to values up to 0xffffffff, resulting in allocations of only 0 to 15 bytes.

The object’s actual logical length remains large. However, its data pointer is 16 bytes beyond the allocation base. Consequently, copying attacker-controlled data writes beyond the allocated memory.

The attacker doesn’t need to send large amounts of data; a small frame containing the malicious length and overflow bytes can cause corruption.

The exploitation process combines allocator grooming with return-oriented programming (ROP). An initial heap spray, organized by size, populates the relevant allocation classes, while additional client connections create candidate victim objects.

The overflow attempts to corrupt dispatch-related fields in a neighboring victim object, including control data used for redirecting execution.

To advance the attack, a separate spray populates memory with repeated ROP objects, each with a return-instruction sled followed by a chain that calls the target binary’s system() entry with an attacker-chosen command.

Success in this exploitation remains probabilistic. If the victim object is not adjacent to the tampered buffer, the attempt might crash the AnyDesk service instead of executing the intended command.

Researchers also noted that a minimal Frida trigger can access the vulnerable protocol path through AnyDesk relay connections.

However, this finding does not confirm full relay-based command execution; the released exploit demonstrates only a complete attack over direct TCP connections. AnyDesk has categorized this vulnerability as being limited to direct Linux connections, stating that Windows and macOS are unaffected.

Administrators are advised to upgrade vulnerable Linux installations to AnyDesk version 8.0.3 or later. If immediate patching isn’t feasible, restricting access to TCP port 7070 can reduce exposure to confirmed direct attacks. However, it doesn’t replace upgrading vulnerable installations.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.