GHSA-4vh4-3pc3-32p7: FreeRDP before 3.32.2 Memory Exhaustion via RD Gateway Packet Length
FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdgreceivepacket that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions before 3.32.2 are exposed when they connect to a malicious RD Gateway. The issue is triggered by the gateway before tunnel authentication completes.
What does an attacker need to exploit it?
An attacker needs to operate or control an RD Gateway that the vulnerable client connects to. No client privileges or authentication to the tunnel are required, but the user must initiate the connection.
What is the impact of successful exploitation?
A malicious gateway can send an eight-byte RDG header declaring a packet length of 0x7FFFFFFF, causing the client to attempt a 2 GiB allocation. This can exhaust memory and deny service to the client.
What should be done if patching cannot happen immediately?
Avoid connecting affected FreeRDP clients to untrusted or potentially malicious RD Gateways until an update is available. This reduces exposure because exploitation requires a client connection to the attacker-controlled gateway.