Null Pointer Dereference in FreeRDP RDP Sound Channel

Executive Summary

This vulnerability is a null pointer dereference flaw in FreeRDP versions 3.0.0 to 3.32.0. It occurs in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST. A malicious RDP server can exploit this by sending a malformed rdpsnd PDU on a new channel, causing the client to crash and leading to a denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP versions and network traffic for malformed rdpsnd channel PDUs. Check FreeRDP version with 'xfreerdp --version' or 'apt list --installed | grep freerdp'. Monitor RDP traffic for fragmented rdpsnd packets without CHANNEL_FLAG_FIRST but with CHANNEL_FLAG_LAST.

Useful 0 Not Useful 0

Impact Analysis

If you use FreeRDP versions between 3.0.0 and 3.32.0, a malicious RDP server could crash your client application, disrupting your remote desktop session. This could lead to loss of access to remote systems and potential downtime for services relying on RDP connections.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service via a null pointer dereference in FreeRDP's rdpsnd channel. It does not directly impact data confidentiality or integrity but may disrupt system availability. Compliance with GDPR or HIPAA typically focuses on data protection and availability; while this issue affects availability, it does not inherently violate these standards unless service disruption leads to non-compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable the rdpsnd channel if not needed by setting 'disable channels=rdpsnd' in FreeRDP configuration. Block or monitor RDP traffic from untrusted sources until patched.

Useful 0 Not Useful 0