Heap Out-of-Bounds Read in FreeRDP Android Client

Executive Summary

This is a heap out-of-bounds read vulnerability in the FreeRDP Android client before version 3.32.1. It occurs when a malicious RDP server sends crafted data with oversized dimensions (mappedWidth and mappedHeight) in a specific protocol unit (RDPGFX_MAP_SURFACE_TO_WINDOW_PDU). The Android client's function android_UpdateWindowFromSurface copies heap memory beyond its allocated bounds, potentially causing crashes or exposing sensitive memory.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the FreeRDP Android client version. If your version is below 3.32.1, the system is vulnerable. Use the command 'apt show freerdp2-android' or 'dpkg -l | grep freerdp' on Linux to check the installed version.

Useful 0 Not Useful 0

Impact Analysis

If you use the FreeRDP Android client before version 3.32.1, an attacker could exploit this flaw by connecting to your client as a malicious RDP server. This could lead to application crashes or unauthorized disclosure of memory contents, which might include sensitive data. The impact depends on what data resides in the affected memory regions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory disclosure. If exploited, it may allow malicious RDP servers to read beyond allocated memory, potentially exposing sensitive data processed by the Android client. This could violate confidentiality requirements under both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade FreeRDP to version 3.32.1 or later to patch the vulnerability.
• Restrict network access to FreeRDP servers from untrusted sources to reduce exposure.
• Monitor for crashes or memory disclosure events in FreeRDP Android client logs.

Useful 0 Not Useful 0