GHSA-66mr-7wc7-23vc: FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdrdumppacket that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal StreamSeek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which client configurations are exposed to this denial of service?
Affected FreeRDP clients must have device redirection enabled, TRACE logging enabled, and WinPR assertions enabled. The issue affects versions from 3.27.0 before 3.32.2.
What does an attacker need to do to trigger the issue?
An attacker needs to operate or control a malicious RDP server and induce a client to connect to it. The server sends a malformed RDPDR device-list announcement whose DeviceDataLength exceeds the received packet, causing a fatal Stream_Seek assertion.
What is the impact on an affected client?
The malformed announcement can abort the FreeRDP client, resulting in a denial of service. The provided data does not indicate confidentiality or integrity impact.