GHSA-x4x6-2hrm-hvq9: FreeRDP before 3.32.2 CPU Exhaustion via RDG Control Packet
FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdgprocesscontrolpacket that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.
Event History
Frequently Asked Questions
Which systems are exposed?
FreeRDP clients running versions before 3.32.2 are exposed when they establish an RDG tunnel to a malicious RD Gateway.
What does an attacker need to do to trigger the issue?
The attacker needs to operate or control an RD Gateway that the client connects to, complete the RDG tunnel-open exchange, and send an incomplete keepalive control packet. No attacker privileges are required.
What is the practical impact on an affected client?
The malformed packet can cause an unbounded no-progress read loop, spinning one client thread at full CPU. The reported impact is denial of service through loss of availability.