Null-Pointer Dereference in FreeRDP Smartcard Emulation

Executive Summary

This vulnerability is a null-pointer dereference flaw in FreeRDP's smartcard emulation backend. A malicious RDP server can send a crafted request with a null reader name in SCardGetStatusChange calls. The client's decoder accepts this malformed input, and later string comparison functions like strcmp or _wcscmp crash when processing the null pointer, causing a segmentation fault and terminating the client process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is between 3.0.0 and 3.31.1. Run: freerdp --version. If smartcard emulation is enabled, monitor for crashes during RDP sessions. Enable logging with: freerdp /v:server /log-level:DEBUG /log:freerdp.log.

Useful 0 Not Useful 0

Impact Analysis

The main impact is denial of service. The FreeRDP client crashes when processing a malicious server request but can be restarted. No data loss, code execution, or privilege escalation occurs. The attack requires smartcard emulation to be enabled and the smartcard device-service route to be available on the client.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts availability by causing FreeRDP clients to crash, which may disrupt remote desktop sessions. It does not directly affect confidentiality or integrity of data. Compliance impact depends on system criticality and redundancy measures. For GDPR, availability disruptions could affect data access but not directly violate principles. For HIPAA, similar considerations apply regarding system uptime for healthcare operations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later immediately. Disable smartcard emulation if not required by setting /smartcard:off in RDP connections. Block untrusted RDP servers until patched.

Useful 0 Not Useful 0