Public exploit gives pre-authentication root on AnyDesk for Linux through direct-connection heap overflow

Rick de Jager of the V12 security team disclosed a pre-authentication heap overflow in AnyDesk for Linux, and a working exploit called AnyPwn was published on GitHub on October 8. The flaw is in the session protocol's mode-5 stream packet handler, which adds a 16-byte header to the declared payload length using 32-bit arithmetic without an overflow check, so a crafted length wraps the allocation to a tiny buffer and a single byte overflows it. The exploit uses a ROP chain to run a command as root over direct TCP connections on port 7070. AnyDesk fixed it in Linux 8.0.3, released in June, and has not issued a formal advisory or CVE.

Check

Update AnyDesk for Linux to at least 8.0.3, ideally the latest 8.1.0, and until then block or restrict direct connections to TCP port 7070.

Affected

AnyDesk for Linux 8.0.2, and possibly 8.0.1, lets an unauthenticated attacker overflow a heap buffer over a direct connection and run code as root.

Fix

Upgrade AnyDesk Linux clients to 8.0.3 or later, restrict inbound access to port 7070 to trusted hosts, and prefer relay connections over direct ones.