FreeRDP File Descriptor Exhaustion via Serial IRP Handling

Executive Summary

FreeRDP before version 3.32.0 has a flaw where it fails to close serial handles properly during serial_process_irp_create. A malicious RDP server can exploit this by sending repeated serial IRP_MJ_CREATE requests, causing the client to exhaust available file descriptors and crash when exceeding the limit set by FD_SETSIZE.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual file descriptor usage by FreeRDP processes. Check for repeated serial IRP_MJ_CREATE requests or excessive open file handles in FreeRDP sessions. Use system monitoring tools like lsof or netstat to inspect file descriptors. Look for processes with many open serial device handles or connections to untrusted RDP servers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker controlling an RDP server to crash your FreeRDP client by consuming all available file descriptors. This would terminate your remote desktop session unexpectedly and potentially disrupt your work.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to file descriptor exhaustion in FreeRDP. However, if exploited, it could lead to denial-of-service conditions, potentially impacting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.0 or later to patch the vulnerability. If updating is not possible, restrict network access to FreeRDP clients to trusted RDP servers only. Monitor for suspicious activity such as repeated serial connection attempts. Disable unnecessary serial device redirection in RDP configurations.

Useful 0 Not Useful 0