GHSA-r387-jjq3-87hv: FreeRDP before 3.32.2 Memory Exhaustion via Serial RDPDR Device Control
FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious servers to trigger excessive memory allocation. Attackers running a server with serial redirection can send an IRPMJDEVICECONTROL request with IOCTLUSBPRINTGET1284ID and a near-maximum length to exhaust client memory.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
FreeRDP clients before 3.32.2 are exposed when they connect to a malicious server using serial redirection. The issue is triggered on the client side by a server-sent serial device-control request.
What must an attacker do to exploit it?
An attacker must operate a malicious RDP server and induce a client to connect to it. The server sends an IRP_MJ_DEVICE_CONTROL request using IOCTL_USBPRINT_GET_1284_ID with a near-maximum OutputBufferLength to drive excessive client memory allocation.