GHSA-c426-ppvf-jpfg: FreeRDP before 3.32.2 X11 Client Crash via Zero-Width RDPGFX ResetGraphics
FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdiBitmapPaint.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP xfreerdp clients running versions before 3.32.2 are exposed when they connect to a malicious RDP server. The impact described is a client crash, resulting in denial of availability.
What does an attacker need to exploit the vulnerability?
An attacker needs to operate or control an RDP server that a user connects to. Exploitation requires user interaction because the victim must initiate a connection to that server.
How does the malicious server trigger the crash?
The server sends an RDPGFX ResetGraphics PDU with a zero width. This causes a failed resize that leaves the primary display null, and a subsequent bitmap update crashes the client.
What version resolves the issue?
Upgrade FreeRDP to version 3.32.2 or later. The vulnerability affects versions before 3.32.2.