REDHAT-BUG-2509985: Use After Free
FreeRDP before 3.29.0 contains a client-side heap use-after-free in the async update message proxy for WINDOWICONORDER when AsyncUpdate is enabled (e.g. xfreerdp /async-update). In updatemessageWindowIcon() a shallow CopyMemory() overwrites a freshly allocated lParam->iconInfo with the parser-owned windowIcon->iconInfo pointer. After the parser callback returns, updaterecvwindowinfoorder() frees windowicon.iconInfo, but the queued async message still retains and later dispatches that stale pointer. A malicious or compromised RDP server sending a crafted RAIL Window Alternate Secondary Order with WINDOWORDERICON can trigger use-after-free, leading to memory corruption and client crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.29.0
Event History
Frequently Asked Questions
Which FreeRDP clients are exposed?
Clients running a version before 3.29.0 are exposed when AsyncUpdate is enabled, such as when xfreerdp is launched with /async-update. The issue is client-side and is triggered while processing RAIL window icon update data.
What does an attacker need to exploit this?
An attacker needs to control or compromise an RDP server that the affected client connects to. The server must send a crafted RAIL Window Alternate Secondary Order containing WINDOW_ORDER_ICON data.
What is the likely impact on an affected client?
Successful triggering causes a heap use-after-free in the client, which can result in memory corruption and a client crash.