GHSA-fqcj-rwww-2498: FreeRDP before 3.32.2 Shadow Server CPU Exhaustion via Zero-Length DVC DATA
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDPWTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
FreeRDP shadow server deployments running versions before 3.32.2 are affected. Exposure requires that authenticated RDP clients can connect to the shadow server.
What access does an attacker need to trigger the issue?
The attacker needs valid authentication to establish an RDP connection. No user interaction is required after connection; the client can send zero-length drdynvc DATA PDUs on opened audin or rdpgfx channels.
What is the operational impact of a successful attack?
The affected server threads can spin because zero-length messages are not consumed by FreeRDP_WTSVirtualChannelRead. This can consume full CPU cores until the attacker disconnects, causing denial of service.