GHSA-5qqp-5ffm-m3p9: FreeRDP before 3.32.2 Denial of Service via Malformed Drive IRP
FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients before 3.32.2 are exposed when they connect to a malicious RDP server that can send drive DEVICE_IOREQUEST messages. The impact is loss of availability for the affected session through memory exhaustion.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the vulnerable FreeRDP client connects to. No attacker privileges are required, but the user must initiate or use the RDP session.
How does the denial of service occur?
The server sends a malformed DEVICE_IOREQUEST containing a truncated IRP_MJ_CREATE body, which silently terminates the drive worker. Subsequent requests can then accumulate without bound in the IrpQueue and exhaust memory.
What version resolves the issue?
Upgrade FreeRDP to version 3.32.2 or later. The provided data identifies versions before 3.32.2 as affected.