REDHAT-BUG-2502766: High severity FreeRDP vulnerability
FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdpclientrdpfileapplytosettings() (client/common/file.c) when parsing the selectedmonitors field of a .rdp connection file. The MonitorIds array is allocated through the settings object, and a raw non-owning pointer to it is freed on the strtoul error path without clearing settings->MonitorIds, leaving it dangling; at teardown freerdpsettingsfree() frees the same buffer again. An attacker who convinces a victim to open a crafted .rdp file with oversized monitor tokens can trigger a size-controlled double-free in any FreeRDP CLI client (xfreerdp/sdl-freerdp/wlfreerdp) in the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.28.0 - Compensating control
Until patched, avoid using FreeRDP CLI clients (xfreerdp/sdl-freerdp/wlfreerdp) with untrusted .rdp files, since the default configuration is vulnerable when parsing the selectedmonitors field.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of FreeRDP 3.x through 3.27.1 who open .rdp connection files using FreeRDP CLI clients, including xfreerdp, sdl-freerdp, and wlfreerdp, are exposed. The issue affects the default configuration.
What does an attacker need to exploit it?
An attacker needs to convince a victim to open a crafted .rdp file. The malicious file uses oversized monitor tokens in the selectedmonitors field to reach the error path that triggers the double free.
How can I determine whether a system is affected?
Check whether the installed FreeRDP version is in the 3.x release line through 3.27.1, and whether users open .rdp files with affected FreeRDP CLI clients. Versions before 3.28.0 are affected.