GHSA-8rjm-m7xg-mg6m: FreeRDP before 3.32.2 Denial of Service via RD Gateway extended-auth packet
FreeRDP before 3.32.2 contains a denial of service vulnerability where rdgprocesspacket dispatches a PKTTYPEEXTENDEDAUTHMSG without verifying negotiated mode or auth context. A malicious or compromised RD Gateway can send the extended-auth packet before tunnel authentication, triggering a null-pointer dereference that crashes the client.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions before 3.32.2 are exposed when they connect through a malicious or compromised RD Gateway.
What does an attacker need to exploit it?
The attacker needs to control or compromise the RD Gateway and send an extended-authentication packet before tunnel authentication. No client-side privileges are required, but user interaction is required because the client must connect to the gateway.
What is the impact of successful exploitation?
The crafted packet triggers a null-pointer dereference in the client, causing a denial of service through a client crash.
What should be done if immediate patching is not possible?
Avoid connecting affected FreeRDP clients to untrusted RD Gateways and restrict use to gateways whose integrity and administration are trusted.