GHSA-x8vp-ff7m-294g: FreeRDP before 3.32.2 Shadow Server Denial of Service via remdesk Channel
FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdeskserverthread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal StreamSeek assertion, aborting the server and dropping sessions.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client that can connect to the FreeRDP shadow server can trigger the denial of service. The supplied data does not indicate that unauthenticated clients can exploit it.
What is the impact of successful exploitation?
The attacker can cause the shadow server process to abort by sending a crafted remdesk payload. This drops active sessions and affects availability; no confidentiality or integrity impact is indicated by the provided vector.
What versions should be remediated?
FreeRDP versions before 3.32.2 are affected. Upgrade to 3.32.2 or later.
What is required to trigger the crash?
The attacker sends an 8192-byte remdesk payload that declares an eight-byte PDU length. This reaches an inverted PDU length check and triggers a fatal Stream_Seek assertion in remdesk_server_thread.