GHSA-v3q2-qjvf-7rqw: FreeRDP before 3.32.2 Use-After-Free via dyn-channel-dump Module
FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using FreeRDP's freerdp-proxy with the dyn-channel-dump module are exposed. The affected versions are those before 3.32.2.
What must an attacker do to trigger the vulnerability?
An attacker needs to operate or control a malicious RDP target. The target sends dynamic channel data while the front-side client disconnects, creating the cross-thread teardown race.
What is the practical impact?
The client thread can access freed ChannelData, causing the FreeRDP proxy process to crash. The supplied impact vector indicates availability impact only.
What should be done if upgrading is not immediately possible?
The provided information identifies the dyn-channel-dump module as the affected component, but does not provide a documented workaround. Prioritize preventing connections to untrusted RDP targets until FreeRDP can be updated to 3.32.2 or later.