GHSA-8g9g-hqqp-fw69: FreeRDP before 3.32.2 File Descriptor Exhaustion via Parallel CREATE
FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallelprocessirpcreate that fails to close previous descriptors on repeated IRPMJCREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP clients from 3.0.0 before 3.32.2 are exposed when parallel-device redirection is enabled and they connect to a hostile RDP server. The issue affects the client process rather than the server.
What must an attacker do to exploit it?
An attacker needs to operate or control an RDP server that the victim connects to. The server sends repeated IRP_MJ_CREATE requests through the parallel-device redirection channel; user interaction is required because the client must initiate the connection.
What is the likely impact?
Repeated CREATE requests leak file descriptors until the client's descriptor table is exhausted. This can crash the FreeRDP client process, resulting in a denial of service.