REDHAT-BUG-2519822: Medium severity FreeRDP freerdp vulnerability
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, rdpsndserverrecvformats in channels/rdpsnd/server/rdpsndmain.c frees context->clientformats on a malformed Client Audio Formats PDU without clearing the owning pointer or numclientformats. An authenticated RDP client can trigger an error such as a cbSize larger than the remaining record, leave the dangling pointer in the server context, and cause rdpsndservercontextfree to free the same allocation again at session teardown. This reliably terminates the server and can create allocator-dependent heap corruption. This issue is fixed in version 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated RDP client can trigger the flaw by sending a malformed Client Audio Formats PDU. The affected component is the FreeRDP server-side rdpsnd audio channel handling.
What malformed input triggers the failure?
A Client Audio Formats PDU that causes a parsing error, such as a cbSize value larger than the remaining record, can free the client format allocation while leaving its pointer and count in the server context.
What is the impact after a malformed PDU is processed?
When the RDP session is torn down, rdpsnd_server_context_free may free the same allocation again. This reliably terminates the server and may cause allocator-dependent heap corruption.
Which versions contain the fix?
The issue is fixed in FreeRDP version 3.28.0. Versions prior to 3.28.0 are affected according to the available information.