GHSA-w897-ffhv-5j7g: FreeRDP before 3.32.2 Use-After-Free via USB Redirection Control Channel
FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a channel pointer without a reference and the control-channel close path does not take the device manager's loadinglock. A malicious RDP server can send a control-channel CLOSEREQUEST while the client announces a USB device, freeing the channel before the announcement thread reads channel->Write and crashing the client.
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients before 3.32.2 are exposed when they use the urbdrc USB redirection channel and connect to a malicious RDP server. The described impact is a client crash.
What must an attacker do to trigger the vulnerability?
An attacker operating a malicious RDP server must send a control-channel CLOSE_REQUEST while the client is announcing a USB device. Exploitation depends on this timing race and requires the user to connect to that server.
Are confidentiality or integrity affected according to the supplied severity data?
The supplied vector reports no confidentiality or integrity impact. It reports a high availability impact, consistent with crashing the FreeRDP client.